{"id":95243,"date":"2026-07-19T18:14:38","date_gmt":"2026-07-19T11:14:38","guid":{"rendered":"https:\/\/impress.vn\/?p=95243"},"modified":"2026-07-19T18:14:38","modified_gmt":"2026-07-19T11:14:38","slug":"authorization-giao-dich-the","status":"publish","type":"post","link":"https:\/\/impress.vn\/en\/tin-tuc\/authorization-giao-dich-the\/","title":{"rendered":"Authorization Giao D\u1ecbch Th\u1ebb V\u1eadn H\u00e0nh Ra Sao Trong V\u00e0i Tr\u0103m Mili-Gi\u00e2y?"},"content":{"rendered":"

Khi kh\u00e1ch h\u00e0ng ch\u1ea1m th\u1ebb t\u1ea1i POS ho\u1eb7c b\u1ea5m “Thanh to\u00e1n” tr\u00ean app, ph\u1ea3n h\u1ed3i “Giao d\u1ecbch th\u00e0nh c\u00f4ng” th\u01b0\u1eddng xu\u1ea5t hi\u1ec7n ch\u1ec9 sau ch\u01b0a \u0111\u1ea7y m\u1ed9t gi\u00e2y. V\u1edbi \u0111\u1ed9i k\u1ef9 thu\u1eadt v\u00e0 v\u1eadn h\u00e0nh ng\u00e2n h\u00e0ng, kho\u1ea3nh kh\u1eafc \u0111\u00f3 l\u1ea1i l\u00e0 \u0111i\u1ec3m ngh\u1ebdn r\u1ee7i ro nh\u1ea5t trong to\u00e0n b\u1ed9 v\u00f2ng \u0111\u1eddi giao d\u1ecbch: m\u1ed9t kh\u00e2u authorization giao d\u1ecbch th\u1ebb<\/strong> x\u1eed l\u00fd sai \u2014 thi\u1ebfu ki\u1ec3m tra idempotency, g\u1ed9p l\u1eabn b\u01b0\u1edbc Auth v\u00e0 Capture \u2014 c\u00f3 th\u1ec3 g\u00e2y double-charge, m\u1ea5t giao d\u1ecbch ho\u1eb7c l\u1ecdt gian l\u1eadn. B\u00e0i vi\u1ebft n\u00e0y ph\u00e2n t\u00edch chi ti\u1ebft 8 l\u1edbp ki\u1ebfn tr\u00fac \u0111\u1ee9ng sau m\u1ed9t l\u1ea7n “ch\u1ea1m th\u1ebb”, t\u1eeb Channels Layer \u0111\u1ebfn External Rails Layer, gi\u00fap \u0111\u1ed9i IT\/v\u1eadn h\u00e0nh thanh to\u00e1n h\u00ecnh dung r\u00f5 lu\u1ed3ng x\u1eed l\u00fd v\u00e0 c\u00e1c \u0111i\u1ec3m r\u1ee7i ro c\u1ea7n r\u00e0 so\u00e1t.<\/p>\n

\"Ki\u1ebfn<\/figure>\n

Authorization l\u00e0 g\u00ec trong v\u00f2ng \u0111\u1eddi giao d\u1ecbch th\u1ebb?<\/h2>\n

Authorization l\u00e0 b\u01b0\u1edbc h\u1ec7 th\u1ed1ng x\u00e1c nh\u1eadn th\u1ebb h\u1ee3p l\u1ec7 v\u00e0 \u0111\u1ee7 \u0111i\u1ec1u ki\u1ec7n thanh to\u00e1n \u2014 ch\u01b0a ph\u1ea3i l\u00e0 b\u01b0\u1edbc ti\u1ec1n th\u1ef1c s\u1ef1 di chuy\u1ec3n. V\u1ec1 b\u1ea3n ch\u1ea5t, \u0111\u00e2y ch\u1ec9 l\u00e0 m\u1ed9t “gi\u1eef ch\u1ed7” (hold) tr\u00ean h\u1ea1n m\u1ee9c ho\u1eb7c s\u1ed1 d\u01b0 c\u1ee7a ch\u1ee7 th\u1ebb; ti\u1ec1n ch\u1ec9 th\u1ef1c s\u1ef1 chuy\u1ec3n \u1edf b\u01b0\u1edbc Clearing v\u00e0 Settlement<\/a> di\u1ec5n ra sau \u0111\u00f3. Hi\u1ec3u \u0111\u00fang ranh gi\u1edbi n\u00e0y gi\u00fap \u0111\u1ed9i v\u1eadn h\u00e0nh tr\u00e1nh nh\u1ea7m l\u1eabn ph\u1ed5 bi\u1ebfn: giao d\u1ecbch “approved” kh\u00f4ng \u0111\u1ed3ng ngh\u0129a v\u1edbi giao d\u1ecbch \u0111\u00e3 quy\u1ebft to\u00e1n xong.<\/p>\n

H\u00e0nh tr\u00ecnh 8 b\u01b0\u1edbc c\u1ee7a m\u1ed9t l\u1ea7n authorization<\/h2>\n

\u1ede m\u1ee9c t\u1ed5ng quan, m\u1ed9t giao d\u1ecbch authorization \u0111i qua tr\u00ecnh t\u1ef1: kh\u00e1ch h\u00e0ng ch\u1ea1m\/nh\u1eadp th\u1ebb \u2192 merchant ho\u1eb7c PSP ti\u1ebfp nh\u1eadn \u2192 acquirer x\u1eed l\u00fd<\/a> \u2192 \u0111\u1ecbnh tuy\u1ebfn qua card network \u2192 issuer ra quy\u1ebft \u0111\u1ecbnh \u2192 ph\u1ea3n h\u1ed3i \u0111\u01b0\u1ee3c tr\u1ea3 v\u1ec1 \u2192 merchant x\u00e1c nh\u1eadn v\u1edbi kh\u00e1ch h\u00e0ng \u2192 capture ngay ho\u1eb7c gi\u1eef l\u1ea1i \u0111\u1ec3 settle sau. To\u00e0n b\u1ed9 chu\u1ed7i n\u00e0y th\u01b0\u1eddng di\u1ec5n ra trong kho\u1ea3ng th\u1eddi gian t\u00ednh b\u1eb1ng mili-gi\u00e2y, nh\u01b0ng ph\u00eda sau l\u00e0 8 l\u1edbp ki\u1ebfn tr\u00fac ri\u00eang bi\u1ec7t, m\u1ed7i l\u1edbp \u0111\u1ea3m nh\u1eadn m\u1ed9t vai tr\u00f2 r\u00f5 r\u00e0ng.<\/p>\n

L\u1edbp A \u2014 Channels Layer<\/h3>\n

\u0110i\u1ec3m kh\u1edfi \u0111\u1ea7u c\u1ee7a giao d\u1ecbch: e-commerce checkout, mobile in-app, POS\/terminal, recurring billing, ho\u1eb7c card-on-file. M\u1ed7i k\u00eanh c\u00f3 \u0111\u1eb7c th\u00f9 x\u1eed l\u00fd kh\u00e1c nhau nh\u01b0ng \u0111\u1ec1u h\u1ed9i t\u1ee5 v\u1ec1 c\u00f9ng lu\u1ed3ng authorization ph\u00eda sau.<\/p>\n

L\u1edbp B \u2014 Card Entry & Security Layer<\/h3>\n

Th\u00f4ng tin th\u1ebb (PAN, CVV\/expiry) \u0111\u01b0\u1ee3c thu th\u1eadp, sau \u0111\u00f3 tokenization v\u00e0 encryption \u0111\u01b0\u1ee3c \u00e1p d\u1ee5ng ngay l\u1eadp t\u1ee9c \u0111\u1ec3 gi\u1ea3m ph\u1ea1m vi d\u1eef li\u1ec7u th\u1ebb nh\u1ea1y c\u1ea3m \u0111i qua h\u1ec7 th\u1ed1ng. V\u1edbi giao d\u1ecbch c\u1ea7n x\u00e1c th\u1ef1c m\u1ea1nh, 3DS\/SCA \u0111\u01b0\u1ee3c k\u00edch ho\u1ea1t t\u1ea1i l\u1edbp n\u00e0y, song song v\u1edbi c\u00e1c ki\u1ec3m so\u00e1t theo chu\u1ea9n PCI DSS.<\/p>\n

L\u1edbp C \u2014 Access & Processing Layer<\/h3>\n

Merchant server v\u00e0 payment gateway ti\u1ebfp nh\u1eadn request, \u0111i qua API gateway, ki\u1ec3m tra idempotency (tr\u00e1nh x\u1eed l\u00fd tr\u00f9ng m\u1ed9t giao d\u1ecbch), validate request v\u00e0 chu\u1ea9n ho\u00e1 d\u1eef li\u1ec7u tr\u01b0\u1edbc khi \u0111\u1ea9y ti\u1ebfp v\u00e0o lu\u1ed3ng authorization.<\/p>\n

L\u1edbp D \u2014 Authorization Path Layer<\/h3>\n

\u0110\u00e2y l\u00e0 l\u1edbp l\u00f5i: acquirer switch \u0111\u1ecbnh tuy\u1ebfn giao d\u1ecbch qua \u0111\u00fang network routing t\u1edbi issuer. Issuer th\u1ef1c hi\u1ec7n ki\u1ec3m tra fraud\/risk v\u00e0 ki\u1ec3m tra h\u1ea1n m\u1ee9c\/s\u1ed1 d\u01b0, sau \u0111\u00f3 tr\u1ea3 v\u1ec1 response code t\u01b0\u01a1ng \u1ee9ng.<\/p>\n

L\u1edbp E \u2014 Decisioning Layer<\/h3>\n

K\u1ebft qu\u1ea3 c\u00f3 th\u1ec3 l\u00e0: Approved, Soft Decline, Hard Decline, Referral, Stand-in Processing (khi issuer t\u1ea1m th\u1eddi kh\u00f4ng ph\u1ea3n h\u1ed3i \u0111\u01b0\u1ee3c), ho\u1eb7c \u0111\u1ec1 xu\u1ea5t Retry. Vi\u1ec7c ph\u00e2n lo\u1ea1i ch\u00ednh x\u00e1c t\u1eebng lo\u1ea1i quy\u1ebft \u0111\u1ecbnh l\u00e0 c\u01a1 s\u1edf \u0111\u1ec3 merchant x\u1eed l\u00fd \u0111\u00fang b\u01b0\u1edbc ti\u1ebfp theo \u2014 v\u00ed d\u1ee5 giao d\u1ecbch Soft Decline c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c g\u1ee3i \u00fd th\u1eed l\u1ea1i thay v\u00ec hu\u1ef7 h\u1eb3n.<\/p>\n

L\u1edbp F \u2014 Post-Auth Layer<\/h3>\n

Sau khi \u0111\u01b0\u1ee3c duy\u1ec7t, giao d\u1ecbch c\u00f3 th\u1ec3 \u1edf tr\u1ea1ng th\u00e1i Auth Hold, \u0111\u01b0\u1ee3c Capture ngay, Void, Incremental Auth (t\u0103ng th\u00eam h\u1ea1n m\u1ee9c gi\u1eef), Reversal, ho\u1eb7c g\u1eedi Advice Message. \u0110\u00e2y ch\u00ednh l\u00e0 l\u1edbp m\u00e0 nguy\u00ean t\u1eafc “t\u00e1ch bi\u1ec7t Auth v\u00e0 Capture” c\u1ea7n \u0111\u01b0\u1ee3c tu\u00e2n th\u1ee7 nghi\u00eam ng\u1eb7t.<\/p>\n

L\u1edbp G \u2014 Data & Control Layer<\/h3>\n

To\u00e0n b\u1ed9 giao d\u1ecbch, token, t\u00edn hi\u1ec7u r\u1ee7i ro \u0111\u1ec1u \u0111\u01b0\u1ee3c l\u01b0u v\u00e0o Transaction Store, Token Vault, Risk Signals, Event Stream, Audit Logs v\u00e0 Reporting Store \u2014 ph\u1ee5c v\u1ee5 truy v\u1ebft (traceability) v\u00e0 b\u00e1o c\u00e1o sau n\u00e0y.<\/p>\n

L\u1edbp H \u2014 External Rails Layer<\/h3>\n

L\u1edbp ngo\u00e0i c\u00f9ng k\u1ebft n\u1ed1i v\u1edbi c\u00e1c b\u00ean th\u1ee9 ba: acquirer, card network (Visa\/Mastercard ho\u1eb7c m\u1ea1ng n\u1ed9i \u0111\u1ecba), issuer bank, nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 ch\u1ed1ng gian l\u1eadn, v\u00e0 nh\u00e0 cung c\u1ea5p 3DS.<\/p>\n

Nguy\u00ean t\u1eafc thi\u1ebft k\u1ebf c\u1ea7n tu\u00e2n th\u1ee7<\/h2>\n

T\u1eeb ki\u1ebfn tr\u00fac tr\u00ean, c\u00f3 6 nguy\u00ean t\u1eafc authorization m\u00e0 \u0111\u1ed9i thi\u1ebft k\u1ebf h\u1ec7 th\u1ed1ng payment c\u1ea7n b\u00e1m s\u00e1t: authorize an to\u00e0n, b\u1ea3o to\u00e0n idempotency, t\u00e1ch bi\u1ec7t r\u00f5 Auth v\u00e0 Capture, t\u00f4n tr\u1ecdng response t\u1eeb issuer, h\u1ed7 tr\u1ee3 \u0111\u1ea7y \u0111\u1ee7 c\u01a1 ch\u1ebf reversal, v\u00e0 ghi log \u1edf m\u1ecdi b\u01b0\u1edbc x\u1eed l\u00fd.<\/p>\n

R\u1ee7i ro v\u00e0 c\u00e1c t\u00ecnh hu\u1ed1ng ngo\u1ea1i l\u1ec7 c\u1ea7n l\u01b0u \u00fd<\/h2>\n

Ba \u0111i\u1ec3m r\u1ee7i ro \u0111\u00e1ng ch\u00fa \u00fd nh\u1ea5t khi tri\u1ec3n khai th\u1ef1c t\u1ebf: th\u1ee9 nh\u1ea5t, \u0111\u00e2y l\u00e0 m\u00f4 h\u00ecnh ki\u1ebfn tr\u00fac tham kh\u1ea3o \u0111\u01b0\u1ee3c t\u1ed5ng h\u1ee3p t\u1eeb chia s\u1ebb chuy\u00ean m\u00f4n tr\u00ean LinkedIn, ch\u01b0a ph\u1ea3i chu\u1ea9n ch\u00ednh th\u1ee9c do Visa, Mastercard hay PCI Council ban h\u00e0nh, n\u00ean c\u1ea7n \u0111\u1ed1i chi\u1ebfu th\u00eam v\u1edbi t\u00e0i li\u1ec7u k\u1ef9 thu\u1eadt ch\u00ednh th\u1ee9c c\u1ee7a t\u1eebng scheme khi \u00e1p d\u1ee5ng. Th\u1ee9 hai, idempotency v\u00e0 vi\u1ec7c t\u00e1ch bi\u1ec7t Auth\/Capture l\u00e0 hai nguy\u00ean t\u1eafc d\u1ec5 b\u1ecb b\u1ecf qua trong tri\u1ec3n khai th\u1ef1c t\u1ebf \u2014 n\u1ebfu h\u1ec7 th\u1ed1ng ch\u01b0a t\u00e1ch r\u00f5 hai b\u01b0\u1edbc n\u00e0y, \u0111\u00e2y l\u00e0 \u0111i\u1ec3m r\u1ee7i ro double-charge c\u1ea7n r\u00e0 so\u00e1t \u01b0u ti\u00ean. Th\u1ee9 ba, Stand-in Processing (cho ph\u00e9p acquirer\/network t\u1ef1 ra quy\u1ebft \u0111\u1ecbnh t\u1ea1m th\u1eddi khi issuer kh\u00f4ng ph\u1ea3n h\u1ed3i) \u0111\u00f2i h\u1ecfi n\u0103ng l\u1ef1c k\u1ef9 thu\u1eadt ri\u00eang \u2014 kh\u00f4ng ph\u1ea3i h\u1ec7 th\u1ed1ng n\u00e0o c\u0169ng h\u1ed7 tr\u1ee3, v\u00e0 n\u1ebfu thi\u1ebfu, giao d\u1ecbch c\u00f3 th\u1ec3 fail c\u1ee9ng ngay khi issuer gi\u00e1n \u0111o\u1ea1n.<\/p>\n

Ngu\u1ed3n tham kh\u1ea3o<\/h2>\n