Patent Application
20200184483
The present invention relates to an abnormality detection apparatus, a control method, and a program.
Illegal transactions using bank cash cards or credit cards are a problem. For example, Patent Document 1 is a document that discloses a related art relevant to such an illegal transaction. Patent Document 1 discloses an apparatus that detects that an abnormal transaction of a game currency is performed in a game account. For example, in a case where the same item is sold a predetermined number of times or more in the same account, the account is determined to be an account in which an abnormal transaction is performed.
[Patent Document 1] Japanese Patent Application Publication No. 2014-535097
[Patent Document 2] WO 2014/109127A
[Patent Document 3] Japanese Patent Application Publication No. 2015-49574
The apparatus disclosed in Patent Document 1 determines whether or not a transaction is abnormal for each account. However, for example, in a case where a single person has a plurality of accounts, it is conceivable that an abnormality of a transaction cannot be detected by focusing on transactions performed by one account.
The present invention has been made in view of the above problems. One of the objects of the present invention is to provide a technique for detecting an abnormal transaction with high accuracy.
An abnormality detection apparatus of the present invention includes (1) an acquisition unit that acquires a first combination including two or more types of feature data having uniqueness and (2) a detection unit that acquires a second combination, which includes two or more types of feature data having uniqueness and includes feature data having a high degree of similarity with the feature data included in the first combination, and detects an abnormal state using the feature data included in the first combination and the feature data included in the second combination.
A control method of the present invention is executed by a computer. The control method includes (1) an acquisition step of acquiring a first combination including two or more types of feature data having uniqueness and (2) a detection step of acquiring a second combination, which includes two or more types of feature data having uniqueness and includes feature data having a high degree of similarity with the feature data included in the first combination, and detecting an abnormal state using the feature data included in the first combination and the feature data included in the second combination.
A program of the present invention causes a computer to execute each step of the control method of the present invention.
According to the present invention, there is provided a technique for detecting an abnormal transaction with higher accuracy.
The aforementioned object and other objects, features, and advantages will become more apparent from preferred embodiments described below and the following accompanying diagrams.
Hereinafter, an example embodiment of the present invention will be described with reference to the diagrams. In all the diagrams, the same components are denoted by the same reference numerals, and will not be repeated. In each of the block diagrams, unless otherwise specified, each block represents not the configuration of a hardware unit but the configuration of a functional unit.
A storage device 10 stores transaction information of each transaction. Using the person information of the first transaction acquired by the acquisition unit 2020, the detection unit 2040 acquires transaction information of a transaction, which is executed by a person having a high degree of similarity with the person who executes the first transaction, from the storage device 10. The transaction relevant to the transaction information acquired herein is referred to as second transaction. The detection unit 2040 detects an abnormal transaction using the transaction information of the first transaction and the transaction information of the second transaction.
A camera 30-n (n is a positive integer) is a camera (for example, a surveillance camera) installed in the vicinity of the transaction execution apparatus 20-n. The camera 30 is installed so as to image a person who performs a transaction. Note that, hereinafter, the camera 30-n is simply denoted as camera 30 when explaining matters common to each camera.
In
In this example, the abnormality detection apparatus 2000 acquires transaction information 40-1 of the first transaction executed by the transaction execution apparatus 20-1 and a captured image 50-1 in which a person executing the first transaction is captured. The abnormality detection apparatus 2000 computes the feature value of the person executing the first transaction by analyzing the person included in the captured image 50-1. The abnormality detection apparatus 2000 uses the computed feature value as the person information of the person who executes the first transaction.
Using the feature value of the person who executes the first transaction, the abnormality detection apparatus 2000 acquires transaction information 40 of a transaction, which is executed by a person having a high degree of similarity with the person, from the storage device 10. In the example shown in
The abnormality detection apparatus 2000 detects an abnormal transaction using the transaction information 40-1 and the transaction information 40-2.
Here, the operation of the abnormality detection apparatus 2000 described with reference to
<Advantageous Effect>
According to the abnormality detection apparatus 2000 of the present example embodiment, an abnormality of a transaction is detected based on the transaction information of the first transaction executed by a certain person and the transaction information of the second transaction executed by a person having a high degree of similarity with the person. As described above, since the abnormality detection apparatus 2000 uses information of a plurality of transactions executed by a person having a high degree of similarity, it is possible to detect the abnormality of each transaction, for example, even in a case where these transactions use different bank accounts (accounts of banks). Therefore, compared with a method of detecting the abnormality of a transaction based only on transactions using one account, it is possible to detect the abnormality of a transaction with higher accuracy.
Hereinafter, the present example embodiment will be described in more detail.
<Example of Hardware Configuration of Abnormality Detection Apparatus 2000>
Each functional component of the abnormality detection apparatus 2000 may be realized by hardware (for example, a hard-wired electronic circuit) that realizes each functional component, or may be realized by a combination of hardware and software (for example, a combination of an electronic circuit and a program for controlling the electronic circuit). Hereinafter, a case where each functional component of the abnormality detection apparatus 2000 is realized by the combination of hardware and software will be further described.
The computer 1000 has a bus 1020, a processor 1040, a memory 1060, a storage device 1080, an input and output interface 1100, and a network interface 1120. The bus 1020 is a data transmission line through which the processor 1040, the memory 1060, the storage device 1080, the input and output interface 1100, and the network interface 1120 transmit and receive data to and from each other. The processor 1040 is an arithmetic processing apparatus, such as a central processing unit (CPU) or a graphics processing unit (GPU). The memory 1060 is a primary storage device formed by a random access memory (RAM) or the like. The storage device 1080 is a secondary storage device formed by a hard disk, a solid state drive (SSD), a ROM, a memory card, or the like. However, the storage device 1080 may be formed by a RAM.
The input and output interface 1100 is an interface for connecting the computer 1000 to an input and output device. For example, an input device, such as a keyboard or a mouse, or an output device, such as a display apparatus, is connected to the input and output interface 1100.
The network interface 1120 is an interface for connection with a communication network, such as a wide area network (WAN) or a local area network (LAN).
The storage device 1080 stores program modules for realizing each function of the abnormality detection apparatus 2000. The processor 1040 reads these program modules into the memory 1060 and executes the program modules, thereby realizing the respective functions corresponding to the program modules.
<Process Flow>
<Timing at which Abnormality Detection Apparatus 2000 Operates>
The series of processes (process illustrated in
In another example, the abnormality detection apparatus 2000 may execute the series of processes according to the user's input operation. For example, the user performs an input for specifying a period, in which an abnormal transaction may be performed, with respect to the abnormality detection apparatus 2000. The abnormality detection apparatus 2000 handles each transaction performed during the period as a first transaction, and repeats the series of processes. In this manner, the abnormality detection apparatus 2000 detects an abnormal transaction from transactions performed during the specified period. For example, in a case where a user is requested a cooperation by an administrative organization, such as police, due to the occurrence of an incident of abusing an account, the user performs an input for specifying a period relevant to the incident with respect to the abnormality detection apparatus 2000, so that an abnormal transaction is detected from transactions performed during the period.
<Transaction Handled by Abnormality Detection Apparatus 2000>
The abnormality detection apparatus 2000 can handle various transactions. The transaction handled by the abnormality detection apparatus 2000 is, for example, a transaction using an account. In this case, transaction information includes one or more of the identifier of the account used in the transaction, the name information of the account used in the transaction, the point in time at which the transaction is performed, and the place where the transaction is performed. The name information of the account is, for example, the name, address, or date of birth of the user of the account.
As the account, various things can be handled. For example, the account is a bank account. The transaction in this case is, for example, withdrawing cash from the bank account or a payment using a debit card. In this case, the identifier of the account is, for example, the account number of a bank account.
In another example, the account is an account of a credit card. The transaction in this case is, for example, a payment using a credit card or cashing. In this case, the identifier of the account is, for example, a credit card number.
In another example, the account is a membership service account. The transaction in this case is, for example, shopping using a membership card (for example, payment for a product using points or payment for a product to which a membership discount is applied). In this case, the identifier of the account is, for example, a membership number.
<Example of Computer 1000 for Realizing Abnormality Detection Apparatus 2000>
Various things can be adopted as the specific computer 1000 for realizing the abnormality detection apparatus 2000. For example, the computer 1000 is realized as a transaction execution apparatus (transaction execution apparatus 20 shown in
The computer 1000 may be an apparatus different from the transaction execution apparatus. In this case, for example, the computer 1000 is a server machine used for management of the transaction execution apparatus. In another example, the computer 1000 may be a computer that is prepared separately from the transaction execution apparatus or the above-described server machine in order to realize the abnormality detection apparatus 2000.
In a case where the transaction execution apparatus 20 is used as the computer 1000 for realizing the abnormality detection apparatus 2000, each transaction execution apparatus 20 handles a transaction executed by that transaction execution apparatus 20 itself as a first transaction, thereby detecting an abnormal transaction. On the other hand, in a case where an apparatus other than the transaction execution apparatus 20 is used as the computer 1000 for realizing the abnormality detection apparatus 2000, the abnormality detection apparatus 2000 handles transactions executed by one or more transaction execution apparatuses 20 as first transactions, thereby detecting an abnormal transaction.
<About Storage Device 10>
The storage device 10 is any storage device that can acquire and store transaction information. The abnormality detection apparatus 2000 is communicably connected to the storage device 10. The storage device 10 may be provided inside the abnormality detection apparatus 2000, or may be provided outside the abnormality detection apparatus 2000. In the former case, for example, the storage device 10 is realized as the storage device 1080 shown in
<Acquisition of Information Regarding First Transaction: S102>
The acquisition unit 2020 acquires person information and transaction information of the first transaction. Hereinafter, a method of acquiring person information and a method of acquiring transaction information will be described.
<<Method of Acquiring Person Information>>
The abnormality detection apparatus 2000 acquires a captured image in which a person executing the first transaction is captured, for example, as described above. In addition, the abnormality detection apparatus 2000 computes the feature value of the person executing the first transaction by analyzing the captured image. For example, the feature value represents a feature of the face. The acquisition unit 2020 acquires the computed feature value as person information. Here, a well-known technique can be used as a technique for computing the feature value of a person included in an image.
Here, the camera 30 for imaging a person executing the first transaction may be a camera that generates a video, or may be a camera that captures a still image. In the former case, the captured image acquired by the abnormality detection apparatus 2000 is an image frame that forms the video.
The abnormality detection apparatus 2000 can use any method to acquire a captured image. For example, the abnormality detection apparatus 2000 acquires a captured image by accessing a storage device in which the captured image is stored. The storage device in which the captured image is stored may be provided inside the camera 30 that has generated the captured image, or may be provided outside the camera 30. In another example, the abnormality detection apparatus 2000 may acquire a captured image by receiving the captured image transmitted from the camera 30 or the like.
Note that, the processing for computing the feature value of the person included in the captured image may be performed by an apparatus other than the abnormality detection apparatus 2000. In this case, the acquisition unit 2020 acquires the feature value, as the person information of the person who executes the first transaction, from the apparatus that has computed the feature value described above.
<<Acquisition of Transaction Information of First Transaction>>
There are various methods in which the acquisition unit 2020 acquires the transaction information of the first transaction. Hereinafter, the explanation is divided into a case where the timing at which the abnormality detection apparatus 2000 performs a series of processes is at a timing when the first transaction has been executed, and a case where that is at a timing after the first transaction is finished.
<<<Case in which Abnormality Detection Apparatus 2000 Operates when First Transaction has been Executed>>>
The abnormality detection apparatus 2000 acquires transaction information of the first transaction from the transaction execution apparatus used for execution of the first transaction. Here, it is assumed that the abnormality detection apparatus 2000 is realized as a transaction execution apparatus. In this case, the abnormality detection apparatus 2000 acquires the transaction information of the first transaction generated inside the abnormality detection apparatus 2000.
On the other hand, it is assumed that the abnormality detection apparatus 2000 is realized as an apparatus other than the transaction execution apparatus. In this case, the transaction execution apparatus transmits the transaction information of the first transaction to the abnormality detection apparatus 2000 during the execution of the first transaction (for example, immediately after the start of the first transaction). The abnormality detection apparatus 2000 receives the transaction information transmitted by the transaction execution apparatus.
<<<Case in which Abnormality Detection Apparatus 2000 Operates after First Transaction Finished>>>
The abnormality detection apparatus 2000 acquires the transaction information of the first transaction from the storage device 10. For example, it is assumed that the abnormality detection apparatus 2000 handles each of a plurality of transactions performed in the past as a first transaction and executes the series of processes. In this case, for example, the abnormality detection apparatus 2000 sequentially reads transaction information from the storage device 10, and handles the read transaction information as the transaction information of the first transaction and performs the series of processes. Note that, the transaction information may be read in any order.
<<Method of Combining Person Information and Transaction Information>>
The acquisition unit 2020 acquires a combination of person information and transaction information of the first transaction. For example, person information and transaction information are combined based on the generation date and time of the captured image used for generation of the person information and the transaction date and time shown in the transaction information. More specifically, for example, transaction information is combined with person information having the generation date and time of a captured image used to generate the person information, which is closest to the transaction date and time of the transaction information, among a plurality of pieces of person information. In another example, transaction information is combined with person information having the generation date and time of a captured image used to generate the person information, which is a point in time between the transaction start date and time and the transaction completion date and time of the transaction information, among a plurality of pieces of person information. In this case, the transaction information indicates both the transaction start date and time and the transaction completion date and time.
<Acquisition of Transaction Information of Second Transaction: S104>
The detection unit 2040 acquires transaction information of a transaction performed by a person having a high degree of similarity with the person who has performed the first transaction, using the person information of the person who has performed the first transaction (S104). The number of pieces of transaction information acquired by the detection unit 2040 may be one or more. In the latter case, a plurality of transactions are handled as second transactions.
In a case where the person information indicates the feature value of the person, the detection unit 2040 acquires transaction information of a transaction performed by a person having a feature value with a high degree of similarity with the feature value of the person who performs the first transaction. Hereinafter, each of (1) method of determining a feature value having a high degree of similarity with the feature value of the person who performs the first transaction and (2) method of determining transaction information of a transaction performed by a person having the feature value will be described.
<<Method of Determining Feature Value Having High Degree of Similarity with Feature Value of Person Who Performs First Transaction>>
As a method of determining a feature value having a high degree of similarity with the feature value of the person who performs the first transaction, various methods can be adopted.
Two specific methods are illustrated below.
<<<First Method>>>
S206 to S214 are a loop process A executed for each feature value included in the set U. In S206, the detection unit 2040 determines whether or not an element is included in the set U. In a case where an element is included in the set U, the process shown in
In S208, the detection unit 2040 extracts one feature value of a person who has performed the transaction from the set U. The extracted feature value is denoted as vi. The detection unit 2040 determines whether or not the degree of similarity between the feature value of the person performing the first transaction and the feature value vi extracted from the set U is equal to or greater than a predetermined value (S210). In a case where the degree of similarity between the feature value of the person performing the first transaction and vi is less than the predetermined value (S210: NO), the process shown in
On the other hand, in a case where the degree of similarity between the feature value of the person performing the first transaction and vi is equal to or greater than the predetermined value (S210: YES), the detection unit 2040 determines the feature value vi as the feature value of the person performing the first transaction.
Since S214 is the end of the loop process A, the process shown in
<<<Second Method>>>
In this method, the abnormality detection apparatus 2000 analyzes a video in which a place where a transaction is performed is imaged, and indexes the feature value of a detected person as shown in
The index shown in
In the third layer, nodes corresponding to all the detection IDs obtained from all the captured images processed so far are arranged. The plurality of nodes arranged in the third layer are grouped such that those having a degree of similarity of the feature value equal to or greater than a predetermined value with each other belong to the same group. One group in the third layer represents, for example, a group in which detection IDs of persons estimated to be the same person are collected. Therefore, in
In the second layer, one node (representative node) selected from each of the plurality of groups of the third layer is arranged. The representative node is linked with a group of the third layer to which the representative node belongs. The plurality of nodes arranged in the second layer are grouped such that those having a degree of similarity of the feature value equal to or greater than a predetermined value with each other belong to the same group. Note that, the reference of the degree of similarity in the grouping of the third layer (second threshold value) is higher than the reference of the degree of similarity in the grouping of the second layer (first threshold value.)
In the first layer, one node (representative node) selected from each of the plurality of groups of the second layer is arranged. The representative node is linked with a group of the second layer to which the representative node belongs.
Note that, it is preferable that the above-described index is generated in advance before the processing of the abnormality detection apparatus 2000 shown in
The processing for generating and updating the index may be performed by the abnormality detection apparatus 2000 or may be performed by another apparatus. However, the index may be generated in S104 of
Next, a method of determining a person having a high degree of similarity with the person who has performed the first transaction, using the index shown in
The detection unit 2040 executes a loop process A (S302 to S306) for each node of the first layer. In S302, the detection unit 2040 determines whether or not there is a node of the first layer that is not yet a target of the loop process A. In a case where there is a node of the first layer that is not yet a target of the loop process A, the detection unit 2040 selects one of the nodes of the first layer that is not yet a target of the loop process A. The node of the first layer selected herein is called a node i. Then, the process shown in
The detection unit 2040 determines whether or not the degree of similarity between the feature value of the person performing the first transaction and the feature value of a person corresponding to the node i is equal to or greater than the first threshold value (S304). In a case where the degree of similarity described above is equal to or greater than the first threshold value (S304: YES), the process shown in
On the other hand, in a case where the degree of similarity described above is less than the first threshold value (S304: NO), the process shown in
As described above, in a case where the loop process A has already been executed for all the nodes of the first layer in S302, the process shown in
S310 to S314 are a loop process B executed for one group in the second layer. This group is a group having the node i of the first layer, for which it is determined that the computed degree of similarity is equal to or greater than the first threshold value in S306, as a representative node.
In S312, the detection unit 2040 determines whether or not there is a node, which is not yet a target of the loop process B, in the group to be processed. In a case where there is a node that is not yet a target of the loop process B, the detection unit 2040 selects one of the nodes that is not yet a target of the loop process B. The node selected herein is called a node j. Then, the process shown in
In S312, the detection unit 2040 determines whether or not the degree of similarity between the feature value of the person performing the first transaction and the feature value of a person corresponding to the node j is equal to or greater than the second threshold value (S312). In a case where the degree of similarity described above is equal to or greater than the second threshold value (S312: YES), the process shown in
On the other hand, in a case where the degree of similarity described above is less than the second threshold value (S312: NO), the process shown in
In S316, processing is performed for one group in the third layer. This group is a group of the third layer having the node j of the second layer, for which it is determined that the computed degree of similarity is equal to or greater than the second threshold value in S312, as a representative node. The detection unit 2040 determines the feature value of the person corresponding to the node included in the group of the third layer as a feature value having a high degree of similarity with the feature value of the person who performs the first transaction.
<<Method of Determining Transaction Information of Transaction Performed by Person Having Certain Feature Value>>
The detection unit 2040 acquires transaction information of a transaction, which is performed by a person having the feature value determined by the first method or the second method described above, from the storage device 10. The transaction information acquired herein is handled as transaction information of the second transaction.
Transaction information of a transaction performed by a person having a certain feature value can be determined based on, for example, the generation date and time of a captured image used for computation of the feature value and the transaction date and time of the transaction information. The specific method is the same as the above-described method of combining person information and transaction information.
An association between a feature value (person information) and transaction information of a person that are computed from a video may be generated in advance and stored in the storage device 10. For example, processing for generating the association is periodically executed at predetermined periods. An apparatus that performs this association may be the abnormality detection apparatus 2000 or may be an apparatus different from the abnormality detection apparatus 2000.
The transaction information 504 includes an identifier 506, name information 508, transaction date and time 510, and a transaction place 512. The identifier 506 indicates an identifier of an account (for example, an account number of a bank account). The name information 508 indicates name information of an account (for example, the name or the address of a holder of a bank account). The transaction date and time 510 indicates the date and time at which a transaction was performed. The transaction place 512 indicates a place where a transaction was performed. For example, the transaction place 512 indicates the address or the global positioning system (GPS) coordinates of a place where a transaction was performed.
In the case of using the table 500, the detection unit 2040 performs a search on the table 500 with the feature value determined by the first method or the second method described above, thereby acquiring transaction information of a transaction performed by a person having the feature value.
<Detection of Abnormal Transaction: S106>
The detection unit 2040 detects an abnormal transaction using the transaction information of the first transaction and the transaction information of the second transaction (S106). For example, the detection unit 2040 detects an abnormal transaction based on a difference in the transaction place or the identifier of an account indicated by each piece of transaction information. Specifically, predetermined conditions for determining that there is an abnormal transaction are set in advance.
Note that, in S404, the detection unit 2040 may detect an individual transaction, such as the first transaction or the second transaction, as an abnormal transaction, or may only determine that “an abnormal transaction has been detected” without determining individual transactions.
Hereinafter, some examples of conditions for detecting an abnormal transaction will be illustrated.
<<Conditions 1>>
The detection unit 2040 detects an abnormal transaction in a case where the conditions that “a predetermined number or more of transactions in which pieces of name information of accounts are different are present among the first transactions and the second transactions” are satisfied. “Pieces of name information of accounts are different” means that the names of users of accounts are different, for example. It is preferable that the predetermined number is, for example, three or more. In this case, two or more second transactions are present.
In this case, for example, in a case where persons estimated to be the same perform transactions using a plurality of accounts whose names are different from each other, abnormal transactions are detected. It is considered that it is not common that a single person performs transactions using a plurality of accounts whose names are different from each other. Therefore, the abnormality detection apparatus 2000 detects abnormal transactions in a case where such uncommon transactions are performed.
<<Conditions 2>>
The detection unit 2040 detects an abnormal transaction in a case where the conditions that “a predetermined number or more of transactions in which types of accounts are the same and identifiers of the accounts are different are present among the first transactions and the second transactions” are satisfied. The situation “types of accounts are the same” is, for example, a situation in which all accounts are accounts of the same bank, a situation in which all accounts are accounts of the same credit card, or a situation in which all accounts are accounts under the same membership service. It is preferable that the predetermined number is, for example, three or more. In this case, two or more second transactions are present.
In order to compare the types of accounts, for example, information indicating the type of each account is included in transaction information. However, in a case where information for distinguishing the type of each account (for example, a numerical value of a predetermined digit) is included in the identifier of the account, information indicating the type of the account may not be additionally included in the transaction information.
In this case, for example, in a case where persons who seem to be the same withdraws cash using a large number of bank accounts in the same bank, abnormal transactions are detected. It is considered that it is not common that the same person performs transactions using a large number of bank accounts in the same bank. Therefore, the abnormality detection apparatus 2000 detects abnormal transactions in a case where such uncommon transactions are performed.
In this case, even in a case where name information is not included in the transaction information (for example, in a case where a counterfeit card is used), it is possible to detect an abnormal transaction.
<<Other Additional Conditions>>
The detection unit 2040 may add conditions that “the difference between the transaction date and time of the first transaction and the transaction date and time of the second transaction is within a predetermined time” to each of the conditions described above. This is because a case where transactions using accounts with different names or different identifiers are performed within a short period of time (for example, within several hours) is more likely to involve an abnormal transaction than a case where these transactions are performed within a long period of time.
The detection unit 2040 may add conditions that “the distance between the transaction date and time of the first transaction and the transaction place of the second transaction is equal to or greater than a predetermined distance” to each of the conditions described above. This is because a case where transactions using accounts with different names or different identifiers are performed at distant places (for example, places several tens of kilometers away) is more likely to involve abnormal transactions than a case where these transactions are performed at close places.
Both the conditions that “the distance between the transaction date and time of the first transaction and the transaction place of the second transaction is equal to or greater than a predetermined distance” and the conditions that “the difference between the transaction date and time of the first transaction and the transaction date and time of the second transaction is within a predetermined time” may be added to each of the conditions described above.
<Measures in Case where Abnormal Transaction is Detected>
There are various measures in a case where an abnormal transaction is detected by the detection unit 2040. For example, in a case where an abnormal transaction is detected, the transaction execution apparatus 20 the transaction execution apparatus stops the first transaction. In this manner, it is possible to prevent the occurrence of damage due to an abnormal transaction. Note that, in this case, a series of processes by the abnormality detection apparatus 2000 are executed at a timing at which the first transaction is performed.
Note that, in a case where the abnormality detection apparatus 2000 is realized by an apparatus other than the transaction execution apparatus 20, the abnormality detection apparatus 2000 notifies the transaction execution apparatus 20 that an abnormal transaction has been detected. The transaction execution apparatus 20 stops the first transaction in response to the notification.
In another example, in a case where an abnormal transaction is detected, the abnormality detection apparatus 2000 transmits a warning to a server that manages the transaction execution apparatus 20 or a mobile terminal of an administrator of the transaction execution apparatus 20. It is preferable that the warning includes a captured image, in which the person who performs the first transaction is imaged, or transaction information of the first transaction. As a technique for transmitting a warning to a server or a mobile terminal, a well-known technique can be used. In this case, a series of processes by the abnormality detection apparatus 2000 may be executed while the first transaction is being performed, or may be executed after the first transaction is finished.
In another example, in a case where an abnormal transaction is detected, the abnormality detection apparatus 2000 may notify a predetermined organization of the abnormal transaction. At the time of this notification, it is preferable that a captured image in which the person who performs the first transaction is imaged or transaction information of the first transaction is transmitted to the organization. The predetermined organization is an organization managing an account of a transaction determined to be abnormal (such as a bank or a credit card company) or an administrative organization such as a police. In this case, a series of processes by the abnormality detection apparatus 2000 may be executed while the first transaction is being performed, or may be executed after the first transaction is finished.
While the example embodiment of the present invention has been described with reference to the diagrams, these are only illustration of the present invention, and other various configurations may also be adopted.
This application claims priority from Japanese Patent Application No. 2016-203929, filed on Oct. 17, 2016, the entire contents of which are incorporated herein.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2016-203929 | Oct 2016 | JP | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2017/027219 | 7/27/2017 | WO | 00 |
