Fake COD Orders: How to Spot COD Fraud and Stop It Before Dispatch

Fake COD orders are cash-on-delivery orders placed with no intention of paying: pranks, sabotage, serial refusers, duplicates and junk addresses. You catch them before dispatch by checking a few signals, such as repeat-RTO phone numbers, gibberish addresses, pincode-city mismatches and burst orders, then routing flagged orders through OTP or WhatsApp confirmation, partial COD or a hold.

What do fake COD orders look like?

Not every refused COD parcel is fraud. A buyer who changed their mind is a different problem from someone who never meant to accept the order. It helps to name the types, because each one needs a different filter.

• Prank orders placed in someone else's name, often to a friend's or colleague's address. The recipient has never heard of you.
• Sabotage orders from a competitor or a disgruntled ex-customer, usually several at once, sometimes high value.
• Serial refusers, real people who order COD from many stores and accept only some parcels. Their phone numbers repeat across your RTO list.
• Duplicates, where the same buyer orders twice by mistake, or orders the same product from several sellers and accepts whichever arrives first.
• Junk-address orders with text like 'asdf', a city name and nothing else, or a pincode from another state. Some are pranks; some are just careless.

What does a fake COD order cost you?

More than the freight. Assume forward freight of ₹70, RTO freight of ₹70, ₹15 of packaging and ₹10 of pick-and-pack labour: ₹165 per fake order, before the stock spends a week or more in transit and returns processing. If 3% of 1,000 monthly COD orders are fake, that is 30 orders and about ₹4,950 a month, plus the inventory you could not sell. The number grows quickly in categories like phones, audio and accessories, which is why electronics sellers tend to need stricter COD rules.

Which red flags signal a fake COD order?

No single signal proves fraud. Treat each as a weight, and act on combinations. A first-time buyer with a gibberish address and a ₹6,000 COD cart is a very different order from a repeat customer whose address lacks a house number.

Check serviceability as part of the same pass. A pincode your courier cannot reach will come back as RTO whether the buyer is genuine or not, and the pincode serviceability checker tells you that before you pack anything.

How do you verify a COD order before shipping it?

1. 1OTP at checkout for COD. A one-time password sent by SMS proves the number is real and belongs to the person ordering. Apply it to COD only, or to COD above a value, so prepaid buyers see no extra step.
2. 2Automatic checks on every order. Pincode against city and state, minimum address quality (house or building, street or landmark), duplicate check on phone and address, and a lookup against your blocklist.
3. 3Flag, do not block. Orders that pass every check ship as normal. Orders that trip a rule go to confirmation.
4. 4WhatsApp confirmation. Send the order summary with Confirm, Cancel and Pay now buttons. Pay now gives a genuine buyer a fast route out of the queue.
5. 5Hold rule. If a flagged order is not confirmed within a set window, say 24 hours, try one call. No answer means cancel, not ship.
6. 6Partial COD for confirmed but risky orders. A small UPI advance on high-value or high-RTO-pincode orders filters the rest.
7. 7Blocklist with rules. Add a phone number or address after repeated refusals with no NDR reason that explains them, set an expiry, and let a blocked buyer order prepaid.
8. 8Close the loop monthly. Feed every RTO and refusal reason back into the rules, and drop rules that flag mostly genuine buyers.

How do you stop fake orders without hurting genuine buyers?

The risk with fraud rules is that they start catching real customers. A few habits keep the filter narrow.

• Add friction only to flagged orders. If every COD buyer gets an OTP, a confirmation and a call, you will lose good orders to impatience.
• Do not treat landmark-style addresses as junk. 'Near Hanuman Mandir, opposite the post office' is a normal Indian address, especially outside metros.
• Read the NDR reason before blocking anyone. 'Customer not available' twice is a scheduling problem; 'customer refused' twice is a pattern.
• Always offer a way back. A blocked or flagged buyer should still be able to pay online and get the parcel.
• Review the blocklist on a schedule and expire old entries, rather than letting it grow forever.

That last point has a legal side. Phone numbers and addresses on a blocklist are personal data, and India's Digital Personal Data Protection Act, 2023, with its Rules notified in November 2025, is built on principles including purpose limitation, data minimisation and storage limitation. Keep only what you need for fraud prevention, for as long as you need it. This is not legal advice; confirm your obligations with a lawyer.

Should you turn off COD to stop fraud?

For most Indian D2C brands, no. COD still brings in buyers who will not pay online for a first order, and switching it off everywhere trades a fraud problem for a conversion problem. A targeted approach costs less: prepaid-only above a value threshold, for high-RTO pincodes or for flagged buyers, and partial COD in between. The guide to converting COD to prepaid covers incentives that shift genuine buyers, and the RTO reduction playbook covers the non-fraud causes of returns.