JP2005122266A - System and method for card-usage transaction processing, and program for card-usage transaction processing - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide card-usage transaction processing technology that can minimize monetary damage by preventing a third person who steals a card etc., from using it in unauthorized manner, without uniformly going through a special authentication procedure, and that will not spoil the user's convenience. <P>SOLUTION: The card-usage transaction processing system 100 connected to card-using terminals 10, 11, ..., via a communication network N and having a transaction processing part 162, is provided with: a customer DB 130, which stores identification numbers and transaction limitation information on card-using terminals for each store; a identification number deciding part 152 which decides the identification numbers; a transaction limitation deciding part 153 which decides whether transaction requests from the card-using terminals 10, 11, ..., are for transactions limited by the transaction limitated information; a transaction limitating part 163 which limits the processing of the transaction processing part 162 according to the decision results of the identification number deciding part 152 and transaction limitation deciding part 153; and a transaction permitting part 161 which permits the transaction processing part 162 to perform processing. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a system for performing a transaction using a card from a card using terminal such as an ATM or a CD based on a deposit account of a financial institution such as a bank, and in particular, to protect against unauthorized use of the card. The present invention relates to an improved card use transaction processing system and method, and a card use transaction processing program.

  In recent years, the use of card terminals such as automatic teller machines (hereinafter referred to as “ATM”) and cash dispensers (hereinafter referred to as “CD”) has been widespread, and not only financial institutions stores, but also department stores, supermarkets, and convenience stores. It is installed in various places such as a store in the city, a store dedicated to the street. By using these ATMs and CDs, the user can perform various transactions even without going to the financial institution's window or outside the business hours of the financial institution.

  For example, when a cash withdrawal operation using ATM is performed, it is necessary to insert a cash card and input a personal identification number, which is performed in the following procedure. That is, when the user selects the “drawer” menu displayed on the ATM display device, the screen switches to a screen requesting the insertion of a cash card. When the user inserts the cash card according to the screen, the screen prompts the user to input a personal identification number. Is displayed.

  The ATM is connected to a host computer for deposit management or the like through a dedicated line. When the user inputs a personal identification number, the ATM responds based on the customer information recorded on the cash card from the customer database on the host computer side. The password is retrieved and verified against the entered password (online verification). If the passwords match, it is determined that the cash card is a valid holder and a screen requesting input of the withdrawal amount is displayed. When the user inputs a desired amount, the host computer that receives the requested amount instructs the ATM to issue money if the deposit balance of the user is larger than the amount. Drain cash.

  The widespread use of ATMs and CDs contributes to saving labor costs and improving convenience for users, and is indispensable for the lives of modern people. However, for example, the password of a cash card is generally only four digits. In many cases, the password is set based on information unique to the user, such as the date of birth. For this reason, when a cash card is stolen together with a wallet or bag, or when it is stolen together with a large number of items due to vacant nests etc., items other than cash cards such as driver's license and health insurance card included in the stolen item From the information such as the date of birth described in the above, the PIN will be inferred and cash will be withdrawn.

In order to deal with this, financial institutions are making efforts to call the user to make it difficult to guess the password. However, since it is left to the user's independence, it is difficult to do everything. There are many cases like the above. At present, the progress of personal authentication technology is remarkable, and it is considered to add new authentication means in addition to the password. For example, as a means for determining whether or not a card is a legitimate user, authentication is performed using a system that combines biological authentication means such as iris and voice, or an input device only owned by the user such as a mobile phone. The system which performs is proposed (patent documents 1-3). According to such a system, authentication can be performed with high accuracy, so that security can be improved.
JP 2002-269620 A JP 2002-260071 A Japanese Patent Laid-Open No. 2003-115075

  However, the prior art as described above requires a great deal of cost for uniformly performing special authentication for all users. For example, a monitor or sensor for detecting an iris and a device for recognizing the iris are always in operation, and a database for registering a large amount of authentication information about the iris is required. In particular, it is often difficult to install this in all stores such as department stores, supermarkets, convenience stores, and stores dedicated to the street, not financial institution stores. In addition, receiving a special authentication other than the password every time all users use it impairs the convenience of the card using terminal.

  The present invention has been proposed in order to solve the above-described problems of the prior art, and the purpose of the present invention is to obtain fraud by a third party who stole a card without going through a special authentication procedure. The present invention provides a card use transaction processing system and method, and a card use transaction processing program that can prevent unnecessary use, minimize financial damage, and do not impair user convenience.

  In order to achieve the above object, the invention according to claim 1 is connected to a card using terminal for performing a transaction using a card via a communication network, and responds to a transaction request from the card using terminal. In the card use transaction processing system including a transaction processing unit for performing processing, the transaction request storage unit stores information related to the transaction restriction of the card using terminal, and the transaction request is based on the information stored in the transaction restriction storage unit. A transaction restriction determination unit that determines whether or not the transaction is restricted, and a transaction that restricts the processing of the transaction processing unit in response to the transaction request when it is determined that the transaction restriction determination unit is a restricted transaction A transaction permitting unit that permits a process of the transaction processing unit in response to the transaction request when the transaction limit determining unit determines that the transaction is not limited. To.

  The invention according to claim 10 captures the invention according to claim 1 from the viewpoint of a method, and a computer connected to a card using terminal for performing a transaction using a card via a communication network. In the card utilization transaction processing method for performing processing according to a transaction request from the card utilization terminal, the computer stores information relating to the transaction restriction of the card utilization terminal, and based on the information relating to the transaction restriction, Determining whether or not the transaction request is restricted; determining that the transaction request is restricted; and restricting processing according to the transaction request; and determining that the transaction request is not restricted. And a step of permitting processing according to the transaction request.

  The invention described in claim 14 captures the invention described in claims 1 and 10 from the viewpoint of a computer program, and is connected via a communication network to a card use terminal for performing a transaction using a card. In a card use transaction processing program for causing a computer to execute processing in response to a transaction request from the card using terminal, the computer stores information related to the transaction restriction of the card using terminal, and based on the information related to the transaction restriction The transaction request is determined to be a restricted transaction, and if it is determined to be a restricted transaction, the processing according to the transaction request is restricted, and the transaction is determined not to be restricted. In this case, the processing according to the transaction request is permitted.

  In the inventions according to claims 1, 10, and 14 as described above, even if a person other than a legitimate user tries to make a transaction from a card using terminal with a stolen card, the transaction from the card using terminal is restricted. If it is a request, the transaction is restricted. Therefore, unauthorized use by a third party or the like who stole the card can be prevented without going through a special authentication procedure.

  The invention according to claim 2 includes a transaction processing unit that is connected to a card using terminal for performing a transaction using a card via a communication network and that performs a process according to a transaction request from the card using terminal. In the card usage transaction processing system, an authentication information storage unit that stores authentication information for each card, a transaction restriction storage unit that stores information relating to transaction restrictions of the card usage terminal, and the authentication information storage unit Based on the authentication information, the authentication information determination unit that determines whether the authentication information from the card using terminal matches the authentication information of the card being used in the card using terminal, and the transaction restriction storage unit stores The transaction restriction determination unit that determines whether or not the transaction request from the card using terminal is a transaction that is limited based on the information that has been made does not match the authentication information determination unit When it is determined or when the transaction restriction determination unit determines that the transaction is restricted, the transaction restriction unit that restricts the processing of the transaction processing unit according to the transaction request matches the authentication information determination unit. And a transaction permission unit that permits processing of the transaction processing unit in response to the transaction request when the determination is made and when the transaction restriction determination unit determines that the transaction is not restricted.

  The invention according to claim 11 captures the invention according to claim 2 from the viewpoint of a method, and a computer connected to a card using terminal for performing a transaction using a card via a communication network. In the card utilization transaction processing method for performing processing according to a transaction request from the card utilization terminal, the computer stores authentication information for each card and information relating to transaction restrictions of the card utilization terminal. Determining whether the authentication information from the card using terminal matches the authentication information of the card being used in the card using terminal based on the authentication information, and information relating to the transaction restriction Based on this, the authentication information does not match the step of determining whether or not the transaction request from the card using terminal is a limited transaction When it is determined or when it is determined that the transaction is restricted, the step of restricting the processing according to the transaction request and the case where it is determined that the authentication information matches and the case where it is determined that the transaction is not restricted And a step of permitting processing according to the transaction request.

  The invention described in claim 15 captures the invention described in claims 2 and 11 from the viewpoint of a computer program, and is connected via a communication network to a card use terminal for performing a transaction using a card. In a card use transaction processing program for causing a computer to execute processing in response to a transaction request from the card using terminal, the computer stores authentication information for each card, and information relating to transaction restrictions of the card using terminal And determining whether or not the authentication information from the card using terminal matches the authentication information of the card being used in the card using terminal based on the authentication information, and relating to transaction restrictions of the card using terminal Based on the information, it is determined whether the transaction request from the card using terminal is a limited transaction, and authentication is performed. When it is determined that the information does not match or it is determined that the transaction is restricted, the processing according to the transaction request is restricted, and the authentication information is determined to match, and the transaction is not restricted When it is determined, the processing according to the transaction request is permitted.

  In the inventions according to claims 2, 11 and 15 as described above, correct authentication information inferred from other stolen goods or the like when a person other than a legitimate user tries to make a transaction from a card using terminal using a stolen card. Even if it is input, if the transaction request is from a card-use terminal that restricts the transaction, the transaction is limited. Therefore, unauthorized use by a third party or the like who stole the card can be prevented without providing a special authentication procedure uniformly in addition to the normal authentication procedure.

  The invention according to claim 3 is the card use transaction processing system according to claim 2, wherein the information stored in the transaction restriction storage unit is an additional authentication information storage unit for storing additional authentication information for releasing the restriction, Additional authentication for determining whether or not the additional authentication information input via the communication network matches the additional authentication information of the card being used when the transaction restriction determination unit determines that the transaction is restricted When it determines with an information determination part and the said additional authentication information determination part agree | coinciding, the transaction restriction cancellation | release part which cancels | releases the transaction restriction | limiting by the said transaction restriction | limiting part was provided.

  The invention according to claim 12 captures the invention according to claim 3 from the viewpoint of the method, and in the card transaction processing method according to claim 11, the computer limits the information on the transaction restriction. The step of memorizing the additional authentication information for release and the additional authentication information input via the communication network when it is determined that the transaction is restricted coincides with the additional authentication information of the card being used. Determining whether or not the additional authentication information matches, and releasing the transaction restriction when it is determined that the additional authentication information matches.

  The invention described in claim 16 captures the invention described in claims 3 and 12 from the viewpoint of a computer program. The card use transaction processing program according to claim 15 relates to the transaction restriction in the computer. For the information, additional authentication information for releasing the restriction is stored, and when it is determined that the transaction is restricted, the additional authentication information input via the communication network is the additional authentication information of the card being used. The transaction restriction is released when it is determined that the additional authentication information matches.

  In the inventions according to claims 3, 12 and 16 as described above, a person other than a legitimate user is restricted from dealing with a card use terminal that is restricted in advance, and a legitimate user wants to conduct a trade. In this case, the restriction is released by inputting additional authentication information, and the transaction can be performed. In this way, by performing additional authentication only in a special case, security can be improved without impairing user convenience.

The invention described in claim 4 is the card transaction processing system according to claim 3, wherein the additional authentication information has higher complexity than the authentication information.
In the invention described in claim 4 as described above, the additional authentication information has higher complexity than the normal authentication information, so that even if the card is stolen, the additional authentication information is hard to be inferred and firmly protected from unauthorized use.

  The invention according to claim 5 is the card usage transaction processing system according to claim 3 or claim 4, wherein the input method storage unit stores an input method of additional authentication information to be determined by the additional authentication information determination unit; And an input method determining unit that determines whether or not the additional authentication information input via the communication network is based on the input method stored in the input method storage unit.

  The invention described in claim 13 captures the invention described in claim 5 from the viewpoint of the method, and in the card transaction processing method according to claim 12, the computer inputs additional authentication information to be determined. A step of storing the method, a step of determining whether or not the additional authentication information input via the communication network is compatible with the input method stored as a determination target, and a determination that the input method is compatible Only in the case, the step of releasing the transaction restriction.

  The invention described in claim 17 captures the invention described in claims 5 and 13 from the viewpoint of a computer program. In the program for card use transaction processing according to claim 16, the computer is added as a determination target. The authentication information input method is stored, and it is determined whether the additional authentication information input via the communication network matches the input method stored as the determination target, and is determined to be a compatible input method. Only in some cases, the transaction restriction is released.

  In the inventions according to claims 5, 13 and 17 as described above, not only the consistency of the additional authentication information but also the input method thereof is subject to authentication. Even if the additional authentication information is analogized, it cannot be used if the input method of the additional authentication information is different from that stored in advance, so that the security is improved.

  The invention according to claim 6 is the card use transaction processing system according to any one of claims 3 to 5, wherein the account information storage unit stores information relating to a deposit account for using the card, and the addition When at least one of the usage fee storage unit that stores the usage fee when using authentication information, the storage by the additional authentication information storage unit, and the determination by the additional authentication information determination unit is performed, the account of the deposit account of the card And a charging processing unit that performs a charging process on the information.

  In the invention according to claim 6 as described above, when additional authentication is performed, the economic burden of the additional authentication can be reduced by charging only a user who desires the additional authentication.

  The invention according to claim 7 is the card use transaction processing system according to any one of claims 1 to 6, wherein the information stored by the transaction restriction storage unit is not restricted in use or restricted in use. At least one of information on the store where the card use terminal is installed and information on the upper limit of the transaction amount according to the transaction request from the card use terminal whose use is restricted is included.

  In the invention according to claim 7 as described above, a legitimate user restricts transactions by a card use terminal of a store that is not normally used, so that a third party who has stolen the card cannot use the card use terminal in a place where it is difficult to be captured. It is prevented to make transactions using. In addition, by restricting the upper limit of the transaction amount by such a third party, it is possible to make a small transaction by a legitimate user while maintaining convenience, while minimizing damage caused by unauthorized third party transactions. be able to.

  The invention according to claim 8 is the card use transaction processing system according to any one of claims 1 to 7, wherein the destination is reachable via a communication network as a contact to a valid user of the card. There is a transaction request by an unauthorized person at the destination stored in the contact storage unit when the contact storage unit that stores information on the transaction and the transaction restriction determination unit determines that the transaction is restricted. And a notification unit that outputs information to that effect.

  In the invention described in claim 8 as described above, when there is a person who steals a card and tries to conduct a transaction with the card using terminal, the right user is notified of this, so that an early countermeasure can be taken. It becomes possible.

  The invention according to claim 9 is the card transaction processing system according to claim 8, wherein the account information storage unit stores information related to a deposit account for using the card, and the address stored in the contact storage unit. And an account freezing unit that stops a transaction based on the account when a request for freezing the account corresponding to the card is received.

  In the invention according to claim 9 as described above, when there is a person who steals the card and conducts a transaction by the card using terminal, the account is immediately frozen in response to a request from a legitimate user. Therefore, the spread of damage can be prevented.

  According to the present invention, it is possible to prevent unauthorized use by a third party or the like who stole a card without going through a special authentication procedure uniformly, and to minimize monetary damage. Card usage transaction processing system and method and card usage transaction processing program can be provided.

Hereinafter, the best mode (embodiment) for carrying out the present invention will be described with reference to the drawings.
[Configuration of the embodiment]
[Card transaction processing system]
First, the configuration of the present embodiment will be described with reference to the block diagram of FIG. That is, the card use transaction processing system 100 of this embodiment is connected to the card use terminals 10, 20... And the image processing device E in each store B1, B2, B3. This card-based transaction processing system 100 is typically realized by controlling a computer with a program. The program in this case realizes the virtual functional block shown in FIG. 1 by physically utilizing the computer hardware. The program and the hard disk, CD-ROM, DVD- ROM and other various recording media are each an embodiment of the present invention.

  More specifically, the card-based transaction processing system 100 includes a communication control unit 110, a registration unit 120, a customer database (DB) 130, a customer information extraction unit 140, a determination unit 150, a transaction unit 160, an emergency processing unit 170, an update. A processing unit 180 and an image database (DB) 190 are provided. The communication control unit 110 is means for controlling connection to the communication network N and transmission / reception of information by linking with a router or other network connection device (not shown). The registration unit 120 is a means for performing registration processing by storing various information necessary for transaction processing using the card use terminals 10, 11,... In the customer DB 130. The information registered in the customer DB 130 is as shown in FIG. The customer information extraction unit 140 is a means for extracting information necessary for transaction processing and the like. The determination unit 150 is means for determining various types of information related to transactions. The transaction unit 160 is a means for performing a transaction and processing related thereto based on the information in the customer DB 130 and the determination result in the determination unit 150. The emergency processing unit 170 is a means for performing processing when there is an unauthorized transaction request.

  As shown in FIG. 1, in the registration unit 120, the determination unit 150, the transaction unit 160, and the emergency processing unit 170, the functional blocks set in each unit operate as described below. In addition, this system has a notification unit for making calls to synthesized contacts, sending automatically created e-mails, sending automatically created facsimiles, etc., as necessary. However, illustration is omitted. An abnormality notification unit 171 to be described later may also be used. In addition, description is abbreviate | omitted about the normal input / output apparatus etc. (a keyboard, a mouse | mouth, a display, an input / output terminal etc.) in the card | curd transaction processing system 100.

  The card use transaction processing system 100 as described above can be realized by a computer managed by a financial institution or the like. This computer is not limited to what is realized by a specific unit, and the customer DB 130, the image DB 190, etc. are configured by another single or a plurality of server devices and processed by a plurality of computers according to each functional block. It is also possible to configure a system in which a plurality of units are connected to perform processing, for example, by dispersing. The representatives who provide the services according to this embodiment are financial institutions such as banks, securities companies, insurance companies, credit unions, and post offices. Any organization that provides trading services may be used.

[Store side equipment]
In the stores B1, B2, B3..., Card use terminals 10, 11,..., An image input device P, an image processing device E, a communication control device C, and the like are installed. Stores B1, B2, B3, etc. are generally stores of various financial institutions, stores such as department stores, supermarkets and convenience stores, stores exclusively for card-use terminals on the street, etc., but at least card-use terminals are installed. It does not matter whether the space is indoors, whether it is indoors or outdoors (installed on the outer wall, etc.), whether or not humans are resident. The card use terminals 10, 11... Are terminal devices that perform transactions using cards such as ATMs and CDs, and the number of card use terminals may be one or more. The target cards are generally so-called cash cards and credit cards, but they are issued by various financial institutions, retail stores, etc., and are used for transaction of monetary value using the card use terminals 10, 11. This includes a wide range of things that can be performed. Not only a magnetic card typified by a magnetic stripe card, but also an IC card (contact type, non-contact type), or a card use terminal 10, 11,... That can use a magnetic and IC hybrid type card. It is assumed that the card use terminals 10, 11,... Are provided with a magnetic card reader, a reader / writer, etc. according to the cards that can be used.

  The image input device P is a device that captures a moving image by converting light received through a lens into an electric signal, such as a CCTV camera. However, the camera is not limited to a moving image camera, and may be a camera that captures only a still image or a time-lapse camera. The image processing apparatus E is means for encoding the captured image data into a format suitable for transmission, etc., separately from the image input apparatus P and connected to each other by a signal cable, or integrally with the image input apparatus P. Any image compression method that can be used at present and in the future can be applied, and is not limited to a specific method. The communication control device C performs connection between the card use terminals 10, 11,..., Connection between the image processing device E and the communication network N, transmission / reception of data of the card use terminals 10, 11,. It is a device to perform.

[Communication network]
As the communication network N, any transmission path and transmission medium that can be used at present or in the future can be applied regardless of wired or wireless, and it does not matter what LAN or WAN is used. In addition, a conventional public telephone line network for voice calls and a case of making a voice call using the same are also included. For example, a dedicated line may be adopted for a communication network connecting the head offices in a financial institution, and it is also possible to reduce the line cost burden by adopting IP-VPN, Internet VPN or the like. As for the communication protocol, a so-called Zengin TCP / IP procedure may be adopted, or other currently available or future available protocols may be adopted. The security ensuring method is not limited to a specific one. For access from the user's personal computer PC, mobile phone CH, etc., all means available at present or in the future can be applied on the premise of ensuring security. Note that the personal computer PC and the mobile phone CH in the following description are merely representative examples of terminals used by the user, and any terminals that perform similar functions such as PHS and PDA may be used. Is available.

[Operation of the embodiment]
The procedure of the card use transaction process of the present embodiment as described above will be described. In the following explanation, in order to facilitate the understanding of the present invention, when a user who opened a deposit account of a financial institution performs a procedure such as withdrawal of cash with a card, a third party other than a legitimate user A case where a procedure such as cash withdrawal is performed using a card will be described as an example of the present embodiment.

[registration process]
First, registration processing before the user receives a service by the present system will be described with reference to the flowchart of FIG.
[Opening an account]
A process in which the user opens an account and the card usage transaction processing system 100 registers necessary information is as follows. That is, when a user makes an account contract with a financial institution at a window such as a bank, a person in charge of inputting the financial institution inputs the basic account information of the user into the card transaction processing system 100 using an input device. . Then, the registration request processing unit 121 in the registration unit 120 stores the account basic information in the customer DB 130 to register as an account contractor (step 201). As the basic account information, for example, information necessary for a general deposit account such as a user's address, name, home phone number, FAX number, branch number, account number, deposit amount, personal identification number, seal (or signature), etc. However, it is up to each financial institution to decide what this is. It is possible to include a mobile phone number, e-mail address, work phone number, etc. as emergency contact information.

[Register restriction information]
When using the service according to the present embodiment, the user who has made a contract as described above accesses the card use transaction processing system 100 from a personal computer PC at the user's home or the like. Since the registration guide unit 121 in the registration unit 120 transmits the guide information to the accessed personal computer PC (step 202), the user inputs transaction restriction information based on the guide information displayed on the personal computer PC. Thus, the registration request processing unit 122 of the registration unit 120 that has received this performs a restriction information registration process (step 203). The provision of guidance information by the registration guidance unit 121 and the registration processing by the registration request processing unit 122 typically involve exchanging information via Web pages (including input forms) using HTML and CGI. However, since the existing technology can be applied, details of the communication data transmission / reception procedure are omitted in the following description.

  For example, when the user inputs an account branch number, account number, password, etc. according to the input form displayed on the personal computer PC, the setting screen is displayed. Then, according to the form of the setting screen, the number of main branches (store information) used mainly by the user, the upper limit (upper limit amount) of one-time withdrawal use amount at stores other than the designated main branch, etc. Enter in and send. Then, in the card use transaction processing system 100 that has received this, the registration request processing unit 121 registers the transaction restriction information by storing the store information and the upper limit amount in the customer DB 130. The store information can be registered by a code assigned to each store, but any store can be identified as long as it can be compared with information transmitted from the card use terminals 10, 11,. It may be information.

[Register additional authentication]
In addition, the registration guide unit 121 provides guidance for additional authentication for temporarily canceling the transaction restriction, and when there is a request for additional authentication information registration of the user in response thereto (when there is no use of an auxiliary device described later) ) (Steps 204 and 205), the additional authentication information input (step 207) is registered by the registration request processing unit 122 (step 208). For example, the above restriction information input form includes a menu for selecting an additional authentication method for temporarily canceling the transaction restriction and an input field for authentication information, and the user selects the additional authentication method and enters the authentication information. When transmitted, the registration request processing unit 122 registers the additional authentication information by storing the additional authentication method and the additional authentication information in the customer DB 130. A special usage fee for additional authentication can also be registered.

  The additional authentication information method and authentication information are more complicated (stronger) than the 4-digit password. For example, a method using collation of a PIN of 5 digits or more, a method of collation of a question content that can be known only by a user and a response thereto, a method of collation of a disposable key using a mobile phone mail, voiceprint authentication, etc. . In both the case of authentication using the above normal password and the case of this additional authentication, the input information is temporarily stored in a storage medium such as a memory and then checked against the registered information. Done. Further, the authentication information is appropriately converted into a format suitable for storage / collation according to the type.

  Here, when the user selects voiceprint authentication, it is necessary to use an auxiliary device such as a mobile phone CH as a procedure for registering the voiceprint (step 205). In this case, the user designates and inputs the question contents (such as name) and contact information (such as a mobile phone number). Then, when the registration guide unit 121 calls the specified mobile phone number to call the user (step 206) and outputs the question registered by the user by pseudo voice, the voice of the user who responds to the input is input. Is done. When the voice data is input in this way (step 207), the registration request processing unit 122 registers the information by storing it in the customer DB as authentication information for additional authentication (step 208). In this case, as an auxiliary device, a device that can use high-quality sound, such as a mobile phone that supports the 3GPP (3rd Generation Partnership Project) standard, is desirable.

  After the registration process as described above, the registration guide unit 121 transmits information prompting the user to confirm the operation of the additional authentication, and accordingly, the additional authentication operates normally based on the additional authentication information input by the user. (Step 209). If the confirmation is successful, the registration operation is terminated. In addition, when a user designates and inputs the input method of the additional authentication information at the time of canceling | releasing transaction restrictions, this can be registered similarly. For example, as a method for inputting additional authentication information, a card use terminal 10 that can be used by an unspecified number of people by specifying and registering a telephone number or e-mail address of a mobile phone or PDA that can only be used by a user 20. Additional authentication from a third-party personal computer or mobile phone can be prevented.

[Transaction processing]
Next, transaction processing in response to a request from the card using terminal will be described with reference to the flowchart of FIG.
[Transaction processing for requests from legitimate users]
First, a case where a legitimate user performs a transaction will be described. The necessary information display processing, input operation, and the like in the card using terminals 10, 11... Are the same as those normally performed, and thus the description is simplified. That is, the user specifies a transaction by inserting a card into a store registered as a store to be mainly used in advance, for example, the card using terminal 10 of the store B1.

  In the card-based transaction processing system 100 that has received this transaction request (step 301), the transaction type determination unit 151 determines that the transaction is a transaction that requires a personal identification number, such as “withdrawal” or “transfer from an account”. If it is determined (step 302), a screen prompting input of a password is displayed on the card using terminal 10. In response to this, when the user inputs a correct password, in the card-use transaction processing system 100 that has received the password (step 303), the password determination unit 152 determines that it matches the password registered in the customer DB. (Step 304).

  Then, when the user inputs a desired transaction amount according to the amount input screen displayed on the card use terminal 10, in the card use transaction processing system 100 that has received the transaction amount (step 305), store information of the transaction restriction determination unit 153 The determination unit 153a determines that the store B1 of the card usage terminal 10 or 11 that has requested the transaction is a store that matches the store information registered in the customer DB (a store where transactions are not restricted) (step 306). ). Thereby, since the transaction permission part 161 permits a transaction (step 314), the transaction processing part 162 performs the requested transaction (step 315). Accordingly, the user can receive a service such as “drawing out” a desired amount of cash.

  Next, when a transaction is specified by inserting a card into any of the card use terminals of stores B1 and B3 other than the store B1 registered in advance by the user, authentication with a personal identification number as described above, After receiving the transaction amount (steps 301 to 305), the store information determination unit 153a determines that the card using terminal is from a store other than the registered store B1 (a store where transactions are restricted) ( Step 306). Then, based on the upper limit amount registered in the customer DB 130, the upper limit amount determination unit 153b determines whether or not the requested transaction amount exceeds the upper limit of the registered transaction amount (step 307). If it is determined that the upper limit is not exceeded, the transaction permission unit 161 permits the transaction (step 314), and the transaction processing unit 162 performs the requested transaction process (step 315). Thereby, the user can receive services such as “drawing out” a small amount of cash.

  If it is determined that the upper limit is exceeded, the transaction restriction unit 163 restricts the requested transaction (step 308). For example, an indication that the transaction is not possible is displayed on the card using terminal. At this time, when additional authentication information is registered in advance (step 309), information for requesting input of the authentication information is output (step 310). For example, a screen prompting input of authentication information is displayed on the card using terminal. In response to this, when the user inputs correct additional authentication information using the registered input method, the additional authentication information determination unit 154 receives the input additional information in the card-use transaction processing system 100 that has received this (step 311). Since it is determined that the authentication information matches the additional authentication information registered in the customer DB 130, and the input method determination unit 155 determines that the input method matches the input method registered in the customer DB 130 (step 312). The transaction restriction releasing unit 164 releases the transaction restriction (step 313), the transaction permission by the transaction permission unit 161 (step 314), and the transaction processing by the transaction processing unit 162 is performed (step 315).

  It is conceivable that the additional authentication information is input according to an authentication method registered in advance. For example, when an additional PIN of 5 digits or more is registered, it is input using a screen of a card using terminal of an unregistered store. In the case of an answer to a question that only the user himself / herself knows, the question is sent to a pre-registered input method, for example, the telephone number or e-mail address of the user's personal mobile phone registered in advance as a contact information Then, enter an answer using that phone number or email address. In the case of the disposable key, the disposable key transmitted to the registered mail address is input from the card use terminal of the unregistered store. In the case of voiceprint authentication, a call is made to a registered mobile phone or the like, and the user inputs voice from the phone according to automatic voice guidance.

  Thereby, the user who received additional authentication can receive services, such as "drawing out" cash exceeding the registered upper limit. When such cancellation is made, the billing processing unit 165 performs billing according to a pre-registered usage fee as a special authentication fee, and a debit processing from the account is performed (step 313). It should be noted that the restriction release by the additional authentication is limited to the transaction, and the subsequent new transaction is automatically restricted. Although it may be possible to wait for a re-restriction notification from the user, it may be forgotten. For this reason, security is higher if re-restriction is performed automatically.

[Transaction restriction processing for requests from unauthorized third parties]
Next, when the third party who has stolen the card inserts the card into one of the card-use terminals of stores other than the pre-registered store B1, for example, stores B2 and B3, and designates the transaction, the same as above Then, authentication with a password is performed (steps 301 to 304). Here, if an incorrect password is entered, the password determining unit 152 determines that the registered password does not match the registered password, so the transaction limiting unit 163 limits the requested transaction (step). 316). And the card use terminal is displayed that the transaction is not possible. Even when a third party tries to make a transaction at the unrestricted store B1, authentication with a personal identification number is performed at a minimum.

  When a third party inputs a correct password based on analogy from other stolen goods, the transaction amount is input after authentication with the password is performed in the same manner as above (steps 301 to 304). be able to. In the card use transaction processing system 100 that has received this (step 305), the store information determination unit 153a determines that the card use terminal belongs to a store other than the registered store B1 (step 306). Then, the upper limit amount determination unit 153b determines whether or not the specified transaction amount exceeds the upper limit of the registered transaction amount (step 307). If it is determined that the upper limit is exceeded, the transaction restriction unit 163 restricts the requested transaction (step 308). And the card use terminal is displayed that the transaction is not possible. When it is determined that the upper limit is not exceeded, the transaction permission unit 161 permits the transaction (step 314), and the transaction processing unit 162 performs the requested transaction (step 315). As a result, a third party can receive services such as “withdrawal” of a small amount of cash, but the user can prevent damage to a minimum.

[Urgent processing of requests from unauthorized third parties]
As described above, when a fraudulent third party makes a transaction request and authentication with a personal identification number fails (for example, when it fails a predetermined number of times), a transaction request from a store B2, B3 other than the registered store is issued. When an attempt is made to conduct a transaction exceeding the upper limit (when the additional authentication fails a predetermined number of times, or when no additional authentication information is input even after a predetermined time has elapsed), the abnormality notification unit 171 Then, a warning that such an illegal transaction request has been made is sent to the contact information of the user registered in advance (cell phone, e-mail address, etc.) to notify the abnormality (step 317).

  When the request receiving unit 172 receives an account freezing request from the user, or when receiving a reply indicating that the card using terminal is not used at that time (step 318), the account freezing unit 173 temporarily freezes the corresponding account (step 319). Further, a third party image captured by the image input device P in the store and transmitted to the card use transaction processing system 100 is recorded in the image DB 190 by the image recording unit 174 (step 320). This image is useful for identifying an unauthorized third party, and may be a moving image or a still image.

[Effect of the embodiment]
According to the present embodiment as described above, in stores other than stores registered in advance by a user who is a contractor of an account of a financial institution, the upper limit of the transaction amount that can be performed using the card usage terminal is the amount specified by the user. Limited to This prevents the user from making a high-priced transaction by a third party who has stolen the card and knew the password without losing convenience.

  In other words, in the present embodiment, for high-value transactions, the user uses some specific stores within the main range of action, and other stores only perform small-value transactions such as short-term living expenses and spending. This is focused on the behavior that there is no, and even a store outside the range of behavior can make a small transaction, so the convenience of the user is not impaired at all. On the other hand, a third party who has stolen a card is likely to be caught at a store where an account is opened or a store in a stolen area, so it is common to go to a land far away from these stores and carry out withdrawals, etc. . However, since stores in such land are restricted to high-value transactions exceeding the pre-registered maximum amount, even if the third party can guess the correct PIN, only a small amount can be withdrawn, Damage can be minimized.

  Further, if the user desires, the restriction can be released by performing additional authentication, which is an authentication procedure stronger than the personal identification number, so that convenience can be improved while ensuring security. In particular, since it is possible to specify and register additional authentication input methods such as mobile phone numbers that can only be used by users, even a third party who knows the PIN and additional authentication information. However, even if a third party inputs authentication information for additional authentication using another mobile phone, personal computer, public telephone, etc., other than registered methods, additional authentication cannot be received, Security is improved.

  Further, in this embodiment, unlike the case where biometric authentication is uniformly performed, it is not necessary to spend a great deal of cost, and user convenience is not impaired. That is, it is not necessary to install and operate sensors or the like for all the stores, and the user only needs to receive additional authentication only when the restriction is released, so there is no trouble of receiving authentication every time it is used. With regard to voiceprint authentication at the time of additional authentication, capital investment can be minimized by using the user's mobile phone or the like. Further, in the case of unauthorized use, the user is promptly notified and the account is immediately frozen, so that the spread of damage can be prevented. As well as being able to contact the police as soon as possible (it may be set to automatically report to the police when the account is frozen, etc.), it is also possible to obtain video information of unauthorized third parties Identifies the culprit easily.

  In addition, the user who desires the transaction restriction and the additional authentication according to the present embodiment can reduce a new cost burden due to the introduction of the system by performing a special charge or the like. In particular, a user who places emphasis on security is highly likely to wish to open a new account, so that it is a powerful means for financial institutions to attract and acquire new customers.

[Other Embodiments]
The present invention is not limited to the above embodiment. For example, you may make it restrict | limit all transactions other than a specific store, without registering the upper limit of transaction amount. You may set the upper limit of transaction amount about all the stores. For example, the upper limit may be set higher for stores mainly used, and the upper limit may be set lower for other stores. In the above embodiment, stores that are not restricted in use are registered. However, stores that are restricted in use may be specified and registered, and use in other stores may not require additional authentication. It is also possible to restrict stores by specific companies and industries, such as ATMs at OO banks, ATMs at city banks, ATMs / CDs at convenience stores, and street ATMs / CDs. The upper limit can be set according to the store at that time. “Drawer” is limited, but “transfer” is not limited. For example, a limit may be set for each type of transaction, and a different upper limit may be set for each type of transaction.

  Various methods can be applied to the initial registration of transaction restrictions and additional authentication, and the method of changing the registered contents, such as using a counter of a financial institution, a card using terminal such as ATM / CD, and a personal computer. For example, when it is performed at a financial institution counter, it is conceivable to use a dedicated sheet. The contents to be entered on the form include, for example, the name and account number for identifying the account, the main branch number used frequently, the maximum amount used at other stores, and the additional authentication method used for temporary cancellation. The telephone number and e-mail address of the mobile phone used at the time of designation, emergency, or temporary cancellation can be considered. The authentication information for additional authentication is the number in the case of a “password of 5 digits or more”, the “answer to a question that only the user knows”, the question content with the character restriction and the answer, “mobile phone” In the case of disposable keys using telephone emails, there is no additional note. In the case of voiceprint authentication, fill in the question content (name, etc.) form, and when the contact person registers the mobile phone number and question content in the system, Registration is made by calling the registered phone number from the system and answering the questions heard from it.

  When using a card using terminal such as ATM / CD, registration is performed according to the input screen. In that case, after the authentication by the card and the password, the setting screen is displayed. However, regarding the second and subsequent setting changes, it is desirable that authentication with already registered additional authentication information is also performed. The input contents are the same as those entered on the above paper. In the case of voiceprint authentication, when the contents of a question are input, a call is made from the system to the registered telephone number, and registration is performed by answering the question by a pseudo voice heard from the telephone number. The case of using a personal computer is almost the same as this except that a display screen by a browser or the like is used.

  In addition, it is free to adopt what kind of additional authentication method is adopted. Biological authentication such as “iris” and “fingerprint” shown in the above prior art, and a stronger authentication method such as a sensor for identifying an imprint may be used. It is also possible to combine a plurality of methods. Various interfaces can be considered when obtaining the authentication. For example, in the case of a password of 5 digits or more, a screen for additional authentication is displayed on the card using terminal, whereby the user can be authenticated by inputting the password registered by the user. In this case, it is desirable not to know the required number of input digits in order to prevent analogy by a third party. The allowable number of input failures can be, for example, up to twice as in the case of a 4-digit password, or can be set to other times. In order to conceal the number of digits, if a password such as “execute” is selected after entering a password of 5 digits or more and the process proceeds to the authentication process, the problem of the conventional 4-digit password is That is, it is possible to improve that only the third digit can be corrected, but only the fourth digit cannot be corrected. Furthermore, the password for additional authentication is not included in the same sequence as the conventional 4-digit number, and in order to prevent failure due to misunderstanding, the conventional 4-digit password is not included in the additional authentication. The input can also be set not to count as a failure.

  In the case of an answer to a question that only the user can know, a screen including the contents of the question for additional authentication is displayed on the card-using terminal, and the user's registered answer is entered for authentication. Can do. The answering time can be shortened by selecting the question content to be a selection type such as 3 choices or 4 choices or a YES / NO type. In the case of an answering formula for such a question, there is an advantage that the number of questions can be adjusted according to how the limit is exceeded. For example, if the upper limit is set at 30,000 yen, if the desired amount of transaction is less than 50,000 yen, the additional authentication question is 1 question. If the transaction is between 50,000 and 80,000 yen, the additional authentication question is 2 questions. Q. More than that, one question can be added every 100,000 yen. It can also be authenticated by the correct rate of answers to a large number of questions.

  In the case of a disposable key using e-mail such as a cellular phone, a mail including the contents of the additional authentication disposable key is transmitted to the registered e-mail address, and the disposable key is sent to the card using terminal. In response to this, the user can be authenticated by inputting a disposable key. Contrary to this, the information of the disposable key is displayed on the screen of the card-using terminal, and the contents of the disposable key are put in the body or title of the mail and sent from a mobile phone registered in advance to be authenticated. Is also possible.

  In the case of voiceprint authentication using a mobile phone, the system makes a call to a user's mobile phone registered in advance, establishes a voice link, and then plays a pre-registered question using a voice message. , Wait for a voice response. The user can answer the question by voice from the mobile phone and receive additional authentication. In this case, since it is impossible to utter exactly the same as the registered voice, it is considered that the authentication fails even when the match rate of the voice information to be authenticated is 100%. In addition, it is conceivable that the contents uttered for authentication are recorded several times in the past, and the authentication fails even when the contents coincide with the contents. These are for preventing a malicious third party from recording an utterance used for temporary release by the user and trying to release it illegally.

  Various processes can also be considered when authentication fails. For example, if the additional authentication succeeds, the restriction is temporarily removed, but if it fails, regardless of the method of additional authentication, the phone number or email address of the mobile phone registered in advance will be The “request for a transaction exceeding the limit” is “where the store is” and “additional authentication failed” is notified. In this case, a method for contacting the inquiry window is also notified. Further, when the additional authentication fails, the use of the card itself may be stopped as in the case where the authentication with the conventional 4-digit password has failed.

  In addition, additional authentication may be retried taking into account that additional authentication may fail due to factors that the user is not responsible for, such as the slow response of the card-using terminal and the poor radio wave condition when using a mobile phone. However, the number of possible failures may be set twice or more than usual. In addition, if a deposit is withdrawn from a third party without the user's awareness of the card being stolen, the user will be notified of the mobile phone, etc. as described above. However, at this time, the content of the notification can include the content of what to do in the future in addition to the fact of the failure. For example, it may be possible to select only stop of card use, temporary freeze of an account, or the like. In consideration of the case where the bankbook and the seal were also stolen, the bankbook and the seal may be frozen so that they cannot be withdrawn unless a separate cancellation procedure is taken.

  Further, in the above-described embodiment, as the first authentication method, the method using the personal identification number has been exemplified as usual, but another authentication method that can be used at present or in the future may be adopted. In the above embodiment, for both initial authentication and additional authentication, for example, online verification is performed between a card usage terminal processing system configured in a host computer of a financial institution and a card usage terminal equipped with a magnetic card reader. It was a thing. However, when an IC card, which is expected to be spread in the future, is used, it is difficult to tamper with internal data, so it is possible to perform local verification between a card using terminal equipped with a reader / writer and the IC card. In other words, either one or both of the initial authentication and the additional authentication can be configured not to be authenticated in the card using terminal processing system but to be authenticated in the card using terminal. In this case, for example, any or all of the contents of the customer DB shown in the above embodiment are stored in the memory of the IC chip, and a registration unit, a customer information extraction unit, a determination unit are provided on the card use terminal side. By configuring any or all of the transaction unit, the emergency processing unit, and the update processing unit, the card use terminal itself can be used as a card use transaction processing system. This prevents authentication information and the like from leaking out via the network.

It is a functional block diagram which shows an example of the card utilization transaction processing system of this invention. It is a flowchart which shows the procedure of the registration process by embodiment of FIG. It is a flowchart which shows the procedure of the transaction and transaction restriction | limiting process by embodiment of FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10,11 ... Card use terminal 100 ... Card use transaction processing system 110 ... Communication control part 120 ... Registration part 121 ... Registration guide part 121 ... Registration request processing part 122 ... Registration request processing part 130 ... Customer database 140 ... Customer information extraction part 150 ... Determination unit 151 ... Transaction type determination unit 152 ... PIN number determination unit 153 ... Transaction restriction determination unit 153a ... Store information determination unit 153b ... Upper limit amount determination unit 154 ... Additional authentication information determination unit 155 ... Input method determination unit 160 ... Transaction Unit 161 ... Transaction permission unit 162 ... Transaction processing unit 163 ... Transaction restriction unit 164 ... Transaction restriction release unit 165 ... Billing processing unit 170 ... Emergency processing unit 171 ... Abnormality notification unit 172 ... Request reception unit 173 ... Account freezing unit 174 ... Image Recording unit 180 ... Update processing unit 190 ... Image database B1, B2, B3 ... Store C ... Communication control device CH ... Mobile phone E ... Image processing device N ... Communication network P ... Image input device PC ... Personal computer

Claims (17)

In a card use transaction processing system including a transaction processing unit connected to a card use terminal for performing a transaction using a card, via a communication network, and performing a process according to a transaction request from the card use terminal,
A transaction restriction storage unit for storing information relating to transaction restrictions of the card using terminal;
A transaction limit determination unit that determines whether or not the transaction request is limited based on information stored in the transaction limit storage unit;
When it is determined that the transaction restriction determination unit is a restricted transaction, a transaction restriction unit that restricts the processing of the transaction processing unit according to the transaction request;
When it is determined that the transaction restriction determination unit is not a restricted transaction, a transaction permission unit that permits processing of the transaction processing unit according to the transaction request;
A card transaction processing system characterized by comprising: In a card use transaction processing system including a transaction processing unit connected to a card use terminal for performing a transaction using a card, via a communication network, and performing a process according to a transaction request from the card use terminal,
An authentication information storage unit for storing authentication information for each card;
A transaction limit storage unit for storing information relating to whether the card usage terminal is a transaction limit;
An authentication information determination unit for determining whether the authentication information from the card using terminal matches the authentication information of the card being used in the card using terminal based on the authentication information stored in the authentication information storage unit; ,
Based on the information stored in the transaction limit storage unit, a transaction limit determination unit that determines whether the transaction request from the card using terminal is a limited transaction, and
When it is determined that the authentication information determination unit does not match or when the transaction restriction determination unit determines that the transaction is restricted, a transaction restriction unit that restricts processing of the transaction processing unit in response to the transaction request; ,
When it is determined that the authentication information determination unit matches and when the transaction restriction determination unit determines that the transaction is not restricted, a transaction permission unit that permits processing of the transaction processing unit in response to the transaction request;
A card transaction processing system characterized by comprising: For the information stored in the transaction restriction storage unit, an additional authentication information storage unit for storing additional authentication information for releasing the restriction,
Additional authentication for determining whether or not the additional authentication information input via the communication network matches the additional authentication information of the card being used when the transaction restriction determination unit determines that the transaction is restricted An information determination unit;
When it is determined that the additional authentication information determination unit matches, a transaction restriction release unit that releases the transaction restriction by the transaction restriction unit;
The card transaction processing system according to claim 2, further comprising:   The card use transaction processing system according to claim 3, wherein the additional authentication information is more complicated than the authentication information. An input method storage unit for storing an input method of the additional authentication information;
The additional authentication information input via the communication network is input so that only the additional authentication information input by the input method stored in the input method storage unit is a determination target of the additional authentication information determination unit. An input method determination unit that determines whether or not the input method is stored by the method storage unit;
The card use transaction processing system according to claim 3 or 4, characterized by comprising: An account information storage unit for storing information relating to a deposit account for using the card;
A usage fee storage unit for storing a usage fee when using the additional authentication information;
When at least one of storage by the additional authentication information storage unit and determination by the additional authentication information determination unit is performed, a billing processing unit that performs billing processing on the account information of the deposit account of the card,
The card use transaction processing system according to claim 3, wherein the card use transaction processing system is provided.   The information stored in the transaction restriction storage unit includes information relating to the store where the card use terminal is not restricted or restricted, and the transaction amount corresponding to the transaction request from the card use terminal whose use is restricted. The card usage transaction processing system according to any one of claims 1 to 6, wherein at least one of information on the upper limit is included. A contact storage unit that stores information about a destination that can be reached via a communication network as a contact to a valid user of the card;
When the transaction restriction determination unit determines that the transaction is restricted, a notification unit that outputs information indicating that there is a transaction request by an unauthorized person to the destination stored in the contact storage unit;
The card use transaction processing system according to any one of claims 1 to 7, further comprising: An account information storage unit for storing information relating to a deposit account for using the card;
When receiving a request for freezing an account corresponding to the card from the address stored in the contact storage unit, an account freezing unit that stops transactions based on the account;
The card transaction processing system according to claim 8, further comprising: In a card usage transaction processing method in which a computer connected via a communication network to a card usage terminal for performing a transaction using a card performs processing according to a transaction request from the card usage terminal,
The computer is
Storing information relating to transaction restrictions of the card using terminal;
Determining whether the transaction request is restricted based on the information on the transaction restriction;
A step of restricting processing in response to the transaction request when it is determined that the transaction is restricted;
When it is determined that the transaction is not restricted, a step of permitting processing according to the transaction request;
A card use transaction processing method characterized by comprising: In a card usage transaction processing method in which a computer connected via a communication network to a card usage terminal for performing a transaction using a card performs processing according to a transaction request from the card usage terminal,
The computer is
Storing authentication information for each card;
Storing information relating to transaction restrictions of the card using terminal;
Determining whether the authentication information from the card using terminal matches the authentication information of the card being used in the card using terminal based on the authentication information;
Determining whether or not the transaction request from the card using terminal is a transaction based on the information on the transaction restriction; and
A step of restricting processing in response to the transaction request when it is determined that the authentication information does not match or the transaction is restricted;
And a step of permitting processing according to the transaction request when it is determined that the authentication information matches and when it is determined that the transaction is not restricted. The computer is
Storing additional authentication information for releasing the restriction for information relating to the transaction restriction;
Determining whether the additional authentication information input via the communication network matches the additional authentication information of the card being used when it is determined that the transaction is restricted;
Removing the transaction restriction if it is determined that the additional authentication information matches; and
The card use transaction processing method according to claim 11, comprising: The computer is
Storing an input method of additional authentication information to be determined;
Determining whether additional authentication information input via a communication network is compatible with an input method stored as a determination target;
Removing the transaction restrictions only if it is determined that the input method is suitable;
The card use transaction processing method according to claim 12, comprising: In a card use transaction processing program for causing a computer connected to a card use terminal for performing a transaction using a card via a communication network to execute a process according to a transaction request from the card use terminal,
In the computer,
Storing information on transaction restrictions of the card-using terminal,
Based on the information on the transaction restriction, it is determined whether the transaction request is a restricted transaction,
When it is determined that the transaction is restricted, the processing according to the transaction request is restricted,
A card-use transaction processing program characterized by allowing a process according to a transaction request to be permitted when it is determined that the transaction is not limited. In a card use transaction processing program for causing a computer connected to a card use terminal for performing a transaction using a card via a communication network to execute a process according to a transaction request from the card use terminal,
In the computer,
Storing authentication information for each card,
Storing information on transaction restrictions of the card-using terminal,
Based on the authentication information, it is determined whether the authentication information from the card using terminal matches the authentication information of the card being used in the card using terminal,
Based on the information on the transaction restriction of the card using terminal, it is determined whether or not the transaction request from the card using terminal is restricted,
When it is determined that the authentication information does not match or when it is determined that the transaction is restricted, the processing according to the transaction request is restricted,
A card-use transaction processing program characterized by permitting processing according to a transaction request when it is determined that the authentication information matches and when it is determined that the transaction is not restricted. In the computer,
For information relating to the transaction restriction, store additional authentication information for releasing the restriction,
When it is determined that the transaction is restricted, it is determined whether the additional authentication information input via the communication network matches the additional authentication information of the card being used,
The card use transaction processing program according to claim 15, wherein when it is determined that the additional authentication information matches, the transaction restriction is released. In the computer,
Memorize the input method of additional authentication information to be judged,
Determining whether the additional authentication information input via the communication network matches the input method stored as the determination target;
The card use transaction processing program according to claim 16, wherein the transaction restriction is canceled only when it is determined that the input method is suitable.

Images