An anti-fraud method for use in a network communication system including a plurality of electronic control units (400a-d, 3400a-d) that communicate with each other via a bus (500a, 500b, 500c) in accordance with a Controller Area Network, CAN, protocol, the anti-fraud method comprising: a determination step of determining whether or not content of a predetermined field in a frame which has started to be transmitted meets a predetermined condition indicating fraud; a transmission step of transmitting an error frame before an end of the frame is transmitted in a case where it is determined in the determination step that the content of the predetermined field in the frame meets the predetermined condition; characterised by further comprising: a recording step of recording the number of times an error frame has been transmitted in the transmission step, for each ID represented by content of an ID field included in a frame for which the error frame has been transmitted; and a notification step of providing a notification in a case where the number of times recorded for each ID in the recording step exceeds a predetermined count, wherein the predetermined count represents a value at which a transition to a passive state specified in the CAN protocol in accordance with a rule for handling a transmission error counter is to occur, and in the notification step, in a case where the number of times recorded for an individual ID in the recording step exceeds the predetermined count, it is determined that an electronic control unit that has transmitted a frame having the ID for which the number of times exceeds the predetermined count is a malicious electronic control unit that does not transition to the passive state, and notification of presence of a malicious electronic control unit is provided. a determination step of determining whether or not content of a predetermined field in a frame which has started to be transmitted meets a predetermined condition indicating fraud; a transmission step of transmitting an error frame before an end of the frame is transmitted in a case where it is determined in the determination step that the content of the predetermined field in the frame meets the predetermined condition; characterised by further comprising: a recording step of recording the number of times an error frame has been transmitted in the transmission step, for each ID represented by content of an ID field included in a frame for which the error frame has been transmitted; and a notification step of providing a notification in a case where the number of times recorded for each ID in the recording step exceeds a predetermined count, wherein the predetermined count represents a value at which a transition to a passive state specified in the CAN protocol in accordance with a rule for handling a transmission error counter is to occur, and a recording step of recording the number of times an error frame has been transmitted in the transmission step, for each ID represented by content of an ID field included in a frame for which the error frame has been transmitted; and a notification step of providing a notification in a case where the number of times recorded for each ID in the recording step exceeds a predetermined count, wherein the predetermined count represents a value at which a transition to a passive state specified in the CAN protocol in accordance with a rule for handling a transmission error counter is to occur, and in the notification step, in a case where the number of times recorded for an individual ID in the recording step exceeds the predetermined count, it is determined that an electronic control unit that has transmitted a frame having the ID for which the number of times exceeds the predetermined count is a malicious electronic control unit that does not transition to the passive state, and notification of presence of a malicious electronic control unit is provided.