Method for detecting a risk of replacement of a terminal, corresponding device, program and recording medium

Abstract

A method is provided for detecting a risk of replacement of an authentic electronic payment terminal by a fraudulent electronic payment terminal. The method includes generating an alert when the value of at least one operating characteristic associated with the authentic electronic payment terminal is below at least one predetermined threshold.

Claims

1. A method for detecting, by an electronic device, whether an authentic electronic payment terminal of a merchant user may have been replaced by a fraudulent terminal, the method comprising the following acts performed by the electronic device: obtaining, by the electronic device, at least one piece of information coming from and associated to said authentic electronic payment terminal, the authentic payment terminal being attached to a sales point of the merchant user; determining, by the electronic device, from said at least one piece of information at least one operating characteristic comprising at least one of a number of transactions during a predetermined time period, or a totalized transaction amount corresponding to transactions made during the predetermined time period; and comparing, by the electronic device, said at least one determined operating characteristic with at least one predetermined threshold for said authentic electronic payment terminal and associated by the electronic device geographically with the sales point to which the authentic payment terminal is attached; when a value of the at least one operating characteristic associated with said authentic electronic payment terminal during the predetermined period of time is below said at least one predetermined threshold: generating, by the electronic device, an alert that the authentic electronic payment terminal may have been replaced by a fraudulent terminal; and transmitting, by the electronic device, said generated alert addressed to at least one entity preliminarily associated by the electronic device with the merchant user of said authentic electronic payment terminal.

2. The method according to claim 1, further comprising: the electronic device obtaining said at least one piece of data from the merchant user of said authentic electronic payment terminal; and wherein generating an alert takes account of the at least one piece of data provided by the merchant user of said authentic electronic payment terminal.

3. The method according to claim 2, wherein said piece of data provided by said merchant user belongs to the group consisting of: the at least one time period; a minimum number of transactions made in relation with the at least one time period; a totalized minimum transaction amount corresponding to transactions made in relation with the at least one time period; a combination of said above data.

4. The method according to claim 1, wherein said at least one operating characteristic is associated with said authentic electronic payment terminal via a single identifier of said authentic electronic payment terminal.

5. The method according to claim 1, wherein the method is implemented by the electronic device remotely from the authentic electronic payment terminal.

6. The method according to claim 1, wherein, prior to said generating an alert, the comparing comprises: comparing, by the electronic device, said at least one determined operating characteristic of the authentic electronic payment terminal with the at least one predetermined threshold; and comparing, by the electronic device, an operating characteristic that is geographically associated with the sales point with the at least one predetermined threshold.

7. An electronic device for detecting whether an authentic electronic payment terminal of a merchant user may have been replaced by a fraudulent terminal, the electronic device comprising: a non-transitory computer-readable memory comprising program code instructions stored thereon; and a processor connected to the memory, which is configured by the program code instructions to perform acts of: obtaining at least one piece of information coming from and associated to said authentic electronic payment terminal, the authentic payment terminal being attached to a sales point of the merchant user; determining from said at least one piece of information at least one operating characteristic comprising at least one of a number of transactions during a predetermined time period, or a totalized transaction amount corresponding to transactions made during the predetermined time period; and comparing said at least one determined operating characteristic with at least one predetermined threshold for said authentic electronic payment terminal and associated by the electronic device geographically with the sales point to which the authentic payment terminal is attached; when a value of the at least one operating characteristic associated with said authentic electronic payment terminal during the predetermined period of time is below at least one predetermined threshold: generating, by the electronic device, an alert that the authentic electronic payment terminal may have been replaced by a fraudulent terminal; and transmitting, by the electronic device, said generated alert addressed to at least one entity preliminarily associated by the electronic device with the merchant user of said authentic electronic payment terminal.

8. A computer-readable recording medium on which there is recorded a computer program comprising a set of instructions executable by a computer or a processor of an electronic device to implement a method for detecting by the electronic device, whether an authentic electronic payment terminal of a merchant user may have been replaced by a fraudulent terminal, the method comprising: obtaining, by the electronic device, at least one piece of information coming from and associated to said authentic electronic payment terminal, the authentic payment terminal being attached to a sales point of the merchant user; determining, by the electronic device, from said at least one piece of information at least one operating characteristic comprising at least one of a number of transactions during a predetermined time period, or a totalized transaction amount corresponding to transactions made during the predetermined time period; and comparing, by the electronic device, said at least one determined operating characteristic with at least one predetermined threshold for said authentic electronic payment terminal and associated by the electronic device geographically with the sales point to which the authentic payment terminal is attached; when a value of the at least one operating characteristic associated with said authentic electronic payment terminal during the predetermined period of time is below at least one predetermined threshold: generating, by the electronic device, an alert that the authentic electronic payment terminal may have been replaced by a fraudulent terminal; and transmitting, by the electronic device, said generated alert addressed to at least one entity preliminarily associated by the electronic device with the merchant user of said authentic electronic payment terminal.

Description

5. FIGURES

(1) Other features and advantages of the present disclosure shall appear more clearly from the following description of a preferred embodiment given by way of a simple illustratory and non-exhaustive example and from the appended drawings, of which:

(2) FIG. 1 presents a block diagram of the proposed technique according to one particular embodiment;

(3) FIG. 2 presents a system in which the proposed technique can be implemented according to one particular embodiment;

(4) FIGS. 3 and 4 represent two examples of a device for detection according to the proposed technique in one particular embodiment.

6. DESCRIPTION

6.1. General Principle

(5) The general principle of the disclosure, described with reference to FIGS. 1 and 2, consists in detecting the fact that an operating characteristic CFi is suspect for a given authentic electronic payment terminal, in order to generate an alert on the risk of replacement of the given electronic payment terminal by a fraudulent electronic payment terminal.

(6) For example, the operating characteristic (CFi, CF.sub.j . . . ) corresponds to a number of transactions or to a totalized amount corresponding to transactions expected, for a given time slot, for a given electronic payment terminal, and is considered to be suspect when it does not correspond to the expected values (for example when it is below a predetermined threshold Si).

(7) This situation can especially occur when this authentic electronic payment terminal has been replaced by a fraudulent electronic payment terminal. Indeed, in the case of the replacement of the authentic electronic payment terminal by a fraudulent electronic payment terminal, for example at a sales point or a restaurant, the authentic electronic payment terminal will no longer carry out any transactions because it is the fraudulent electronic payment terminal that is being used.

(8) Thus, if it is detected that the number of transactions (CFi) associated with an electronic payment terminal is below a predetermined threshold denoted as Si, over a given time period, this can be the consequence of a replacement of the electronic payment terminal by a fraudulent electronic payment terminal.

(9) Similarly, if the totalized amounts corresponding to the transactions (CFj) associated with an electronic payment terminal are below a predetermined threshold Sj, over a given period of time, this can also be due to a replacement of the electronic payment terminal by a fraudulent electronic payment terminal.

(10) In these different situations, the method of detection according to the different embodiments of the disclosure implements a step 10 for generating an alert on the risk of replacement of the authentic electronic payment terminal by a fraudulent electronic payment terminal.

(11) To this end, the operating characteristic used to detect a possible fraud by replacement of a terminal can be monitored for a given time period, for example by an entity authorized to analyze certain pieces of data (such as for example each transaction made as well as the amount corresponding to each transaction made) coming from the electronic payment terminal.

(12) For example, this entity corresponds to a remote server 20 as illustrated in FIG. 2, capable of receiving information about a plurality of electronic payment terminals POS1, POS2 . . . POSi.

(13) This remote server 20 can correspond to a server of a banking institution in charge of the management of the transactions of the plurality of the electronic payment terminals, or again a remote server in charge of the management of the security of this plurality of electronic payment terminals, by identifying fraud and tracking the activity of the electronic payment terminals.

(14) This entity 20 can also correspond to an entity situated at the same place as the authentic electronic payment terminal, such as for example a merchant's main computer.

(15) Besides, and as illustrated in FIG. 2, the pieces of data received from each electronic payment terminal, for which the entity 20 is in charge, are identified solely by a unique identifier of the electronic payment terminal. Thus, the entity 20 can carry out the method for detecting a risk of replacement in parallel for a plurality of electronic payment terminals in making sure that each determined operating characteristic is associated uniquely with one particular electronic payment terminal.

(16) Thus, the user data provided for example by the merchant using the authentic electronic payment terminal is associated with the identifier of the electronic payment terminal (IdPOS1, IdPOS2 . . . IdPOSi), along with the information coming from the electronic payment terminals (IdPOS1-info1, IdPOS2-info1 . . . IdPOSi-infoj).

(17) This unique identifier of an electronic payment terminal corresponds to a serial number or is formed by at least two pieces of information enabling the terminal to be identified, such as for example the pair (numTPV, numComm) where numTPV is a serial number of the electronic payment terminal and numComm is the merchant's number enabling him to be identified uniquely.

(18) We shall now provide a more detailed description of two embodiments of the disclosure, with reference to FIG. 2, where the entity 20 corresponds to a remote server.

6.2. Description of a First Embodiment

(19) In a first embodiment, it is assumed that the operating characteristic of the electronic payment terminal used to detect fraud, if any, by replacement of a terminal corresponds to the number of transactions made over a given time period.

6.2.1 Operating Characteristic

(20) For example, this operating characteristic is denoted as CF1, and is determined through information info1 transmitted by the electronic payment terminal to the server 20.

(21) This is for example the case with electronic payment terminals POS1 and POS2, as illustrated in FIG. 2.

(22) Thus, at each transaction made by the electronic payment terminal POS1, the server 20 obtains a piece of information info1 corresponding to this transaction. This piece of information info1 enables especially the server 20 to increment the current number of transactions already made by the electronic payment terminal POS1, during the current time period.

6.2.2 Time Period

(23) It is considered for example that this time period extends from the opening time of the business to which the electronic payment terminal POS1 is attached up to the time when offline transactions, if any, are ended. Indeed, offline transactions of this type are taken into consideration not when they are implemented but only when a communication with the server in charge of the processing of the transactions is initiated, most often outside the opening times of the business.

(24) This time period can be directly provided by the merchant to the server 20 in the form of user data associated with a unique identifier of the given electronic payment terminal (IdPOSiuser data=time slot) or computed by the server 20 from one or more pieces of user data associated with a unique identifier of the given electronic payment terminal (IdPOSiuser data=opening times, opening days, etc.).

(25) Thus, the time period used to implement the method for detecting a risk of fraud can be determined in various ways, according to the data given by the user/merchant.

6.2.3 Comparison with the Threshold

(26) Once the given time period has elapsed, the server can determine the final value of the operating characteristic CF1 used, in this case the number of transactions made, in order to compare it with a predetermined threshold, denoted for example as S1 which can also form part of the user data given to the server 20.

(27) For example, this threshold S1 has been furnished (IdPOS1-user data) to the server by the merchant using the electronic payment terminal POS1 to be monitored, for example via a user interface for parameterizing the method for detecting a risk of fraud.

(28) According to another example, this threshold S1 corresponds to a threshold S1 given by the merchant, subsequently enhanced by data not provided by the merchant, such as for example weighting operations to take account of criteria not controlled by the merchant.

(29) Thus, it can happen that the merchant has computed a threshold S1 from statistics on the activity of his business but without taking account of special random factors which enable false alerts to be limited to the maximum. Such weighting operations correspond for example to the application of a margin of error which is variable according to the threshold value S1 given by the merchant.

(30) For example, when the number of transactions ranges from x to y, then the weighting to be applied corresponds to xy %, whereas when the number of transactions ranges from y to z, the weighting to be applied corresponds to yz %.

(31) These weightings can also take account of a variable risk of attempted fraud such as for example a relatively low risk in a small-sized business where only one electronic payment terminal is used and a relatively high risk in a large-sized business where several electronic payment terminals are used.

(32) These weighting operations can therefore also take account of the number of terminals used in a same business or sales point in order to take account of random factors due to the possibility of one particular electronic payment terminal being used by chance from among the plurality of electronic payment terminals. What has to be done therefore is to smooth the number of transactions over the plurality of electronic payment terminals while at the same time possibly taking account of specific features proper to each electronic payment terminal (the employee in charge of its use, his position in the sales point, etc.).

(33) The server 20 can be in charge of applying these weighting operations and of updating them regularly (for example by pooling the experiences of implementation of the method of detection according to the different embodiments of the disclosure).

(34) Finally, the server compares the operating characteristics CF1 with the predetermined threshold S1 in order to generate or not generate an alert.

(35) Thus, according to this first embodiment, if the number of transactions made on the given time period is below the threshold S1, then an alert on a risk of replacement of the terminal is generated. If not, the method is reactivated (the number of transactions is reset) for the next reference time period, and so on and so forth.

6.2.4 Alert

(36) If an alert is generated, it can be used in different ways, according to different modes of implementation of this embodiment of the disclosure. Indeed, the mode of sending out the alert can be configured so as to be adapted as efficiently as possible to the merchant's needs or to the needs of the user of the electronic payment terminal.

(37) For example, one or more of the merchant's communications terminals will have been pre-recorded in a database of the server 20 as recipients of an alert. This can be a mobile terminal number (a smartphone, tablet, PDA, etc.) to which an SMS message or an email message can be sent. It can also be a landline terminal number to which a call can be sent by an operator or a voice messaging service.

(38) The merchant, on receiving the alert, can then check to see whether the authentic electronic payment terminal has truly been replaced by a fraudulent electronic payment terminal, for example by verifying the serial number of the electronic payment terminal being used. If this verification is not possible or is not reliable (because the fraudulent electronic payment terminal reproduces the serial number of the authentic electronic payment terminal), then the merchant can call on the entity managing the electronic payment terminal to make more precise verifications while stopping the use of the electronic payment terminal suspected of being fraudulent.

6.3. Description of a Second Embodiment

(39) In this second embodiment, the operating characteristic of the electronic payment terminal used to detect any fraud by replacement of a terminal is considered to correspond to the totalized amount corresponding to the transactions made over a given time period.

(40) The different steps implemented in this second embodiment are identical to those described here above with reference to the first embodiment, and are not described in detail here again.

(41) Thus, determining the threshold to be applied, determining the time period to be taken into account and generating and sending out of an alert are identical.

(42) Only the operating characteristic of the electronic payment terminal used is different and no longer corresponds to a number of transactions but to a totalized amount corresponding to the transactions made over the given time period. Indeed, this operating characteristic, depending on each specific case, is more representative of the activity of the electronic payment terminal than of the number of transactions.

(43) Other operating characteristics can also be used depending on other embodiments of the disclosure, inasmuch they can be used to respond to the same problem consisting in observing the habitual activity of an electronic payment terminal to detect a risk of replacement of this electronic payment terminal by a fraudulent electronic payment terminal.

(44) Similarly, a combination of several operating characteristics can be used so as to optimize the performance of the method of detection according to the different embodiments of the disclosure, while minimizing false alerts.

6.4. Other Characteristics and Advantages

(45) Referring to FIGS. 3 and 4, we now describe an example of a device for detecting a risk of replacement of an authentic electronic payment terminal by a fraudulent electronic payment terminal comprising means for executing the method described above.

(46) Thus, as illustrated in FIG. 3, a device 20 of this kind, for example a remote server as described here above with reference to FIG. 2, or again an entity of a sales point, comprises means 30 (for example in the form of one or more modules) for comparing an operating characteristic CFi of an electronic payment terminal with a predetermined threshold Si. The device 20 also comprises means 31 for generating (for example in the form of one or more modules) an alert when the means for comparing have delivered a positive result.

(47) We now describe this device 20 with reference to FIG. 4.

(48) For example, the device comprises a memory 41 constituted by a buffer memory, a processing unit 42, equipped for example with a microprocessor and driven by the computer program 43 implementing a method for detecting a risk of replacement

(49) At initialization, the code instructions of the computer program 43 are for example loaded into a memory and then executed by the processor of the processing unit 42. The processing unit 42 inputs for example an operating characteristic CFi associated with an electronic payment terminal. The microprocessor of the processing unit 42 implements the steps of the method for detecting a risk of replacement of an authentic electronic payment terminal by a fraudulent electronic payment terminal, according to the instructions of the computer program 43, to generate an alert.

(50) To this end, in addition to the buffer memory 41, the device comprises means 30 for comparing an operating characteristic CFi of an authentic electronic payment terminal with a predetermined threshold Si for this electronic payment terminal and means 31 for generating an alert (for example in the form of one or more modules) when the means for comparing have delivered a positive result.