Fake COD Orders on Shopify: How Indian Stores Stop Them
Why fake and prank cash-on-delivery orders pile up on Indian Shopify stores, how to spot them before dispatch, and what stops them coming back.
Every few weeks someone posts the same complaint in r/FacebookAds or r/shopify. A Meta campaign brings in a burst of COD orders, and half of them have names like "test test", phone numbers that never pick up, or addresses that stop at the city. The courier takes them, the parcels come back, and the store pays shipping both ways. Then Meta counts each one as a purchase and goes looking for more people like them.
Fake orders are mostly a COD problem. A prepaid order costs the buyer money up front, so nobody places one as a joke. A COD order costs nothing until the parcel arrives.
Why they keep coming
Most of what we see on Indian stores comes from a few places:
- pranks and spite orders, placed because COD costs nothing to place
- impulse buyers who have changed their mind by the time the courier calls (not fake, but they look the same on your P&L)
- bots and form spam hitting checkout, which tend to arrive in bursts with similar details
Your ad account can make all of this worse. If Meta receives a Purchase event the moment a COD order is placed, it learns that the people placing those orders are your best customers and finds more of them. We covered the fix in Meta ads and COD purchase events: report deliveries to Meta, and leave out orders that were only placed.
Shopify's fraud check won't catch them
Shopify's fraud analysis is built for online card orders that Shopify can verify, using signals like the card's billing address and where the order came from. A COD order has no card behind it, so that risk indicator isn't designed for this problem. You need your own checks.
Spot them before dispatch
Most fake COD orders give themselves away. Go through a week of refused COD orders and you'll usually find the same patterns:
| Signal | What to look for |
|---|---|
| Name | Single letters, "test", keyboard mash, a film star |
| Phone | Fewer than 10 digits, repeated digits, one number on several orders with different names |
| Address | No house or street, only a city, or a pincode that doesn't match the city |
| Order | Many units of one item, or several orders from one phone within an hour |
| History | A previous refused or returned COD order from the same customer |
Shopify Flow is a free app on the Basic plan and above. It can tag orders that match rules like these as they come in, so your team checks the tagged ones before packing. Whatever Flow can't judge, a person can check in a minute.
Confirm before you ship
The cheapest fix is a confirmation step. When a COD order is placed, send a WhatsApp message with buttons to confirm or cancel, and pack only the orders that come back confirmed. Orders with no reply get one phone call. Most fake and impulse orders drop out here, before you've spent anything on shipping. Our WhatsApp integration guide covers the setup.
Some stores also verify the phone number with an OTP at checkout. One-click checkouts used in India, such as GoKwik, which we set up for Vanalaya, verify the phone number and can limit COD on risky orders. That stops many fakes before they become orders, at the cost of a little friction for real buyers.
Make COD cost something
If fake orders keep coming, change what COD costs the buyer:
- Add a small COD fee, or a discount for paying online. Both push serious buyers to prepay.
- Ask for a small advance on high-value COD orders. Several Indian checkout tools support part-prepaid orders.
- Turn off COD for pincodes where most COD orders come back. Your courier's RTO report by pincode shows which ones.
- Keep a list of phone numbers that have refused before, and stop offering them COD.
Shopify's checkout settings also include an add-to-cart limit, which caps how many units of one item can go in a cart. Set it to a number that fits your products, because a bulk COD order for one item is a common fake.
Keep the numbers honest
Count fake and refused orders separately from genuine returns. If they all go into one RTO figure, you can't tell whether a change worked. A weekly count of orders cancelled at confirmation, refused at the door and delivered is enough. If the share of confirmed orders that get delivered goes up, the checks are working. If it doesn't, the problem may be the offer or the delivery promise, which our COD guide goes into.
If the fake orders come from paid campaigns, fix the purchase signal first. Every other step works better once Meta stops being rewarded for finding them.
