Verifying every cash-on-delivery order feels like the responsible thing to do. It's also quietly costing you sales. Risk-based COD verification is the smarter alternative, and it starts by checking far fewer orders, not more.
Verification is one of the best tools COD merchants have. A one-time-password (OTP) check typically pulls fraud from the 8–15% range down to 1–2%. But forcing that step on every customer adds friction for the majority who were always going to pay. The fix is to check only the orders that actually carry risk and let everyone else through.
Get the balance wrong in either direction and it shows up in your numbers. Verify nobody, and fake or careless orders push your return-to-origin (RTO) rate toward the 25–35% that COD already runs, versus 4–8% for prepaid. Verify everybody, and you slow down the trusted buyers who drive most of your revenue. Aim verification only where the risk actually is.
Why Checking Every Order Quietly Hurts You
Most COD fraud advice stops at "turn on OTP for all orders." That works on paper and frustrates real buyers in practice.
Every extra step between "I want this" and "order placed" leaks customers. A repeat buyer who already trusts you doesn't want to dig out their phone for a code on a $20 order. In WhatsApp-first markets, an SMS code that takes two minutes to arrive can lose the sale outright.
The math only works when the cost of verifying is smaller than the fraud it prevents. On a trusted repeat customer, that cost is almost all downside — you're spending conversion to stop fraud that was never coming.
What Risk-Based COD Verification Actually Means
Risk-based COD verification means triggering a check only when an order shows a warning sign, and letting low-risk orders through untouched. The orders worth a second look usually share a few signals:
- First-time customers — no order history means no track record. Most of the fraud and refusals we see cluster on new buyers, not repeats.
- High cart value — a returned $200 order costs far more than a returned $20 one, so the friction is worth it.
- High-RTO regions — if certain cities or postal codes return orders at twice your average, gate those.
- Repeated orders to one address or phone number — a classic fake-order pattern that earns a check.
- Invalid or mismatched phone numbers — a number that fails a basic format check rarely belongs to a real buyer.
Turn verification on for those segments and leave the rest alone. You catch most of the risk while touching a small fraction of your orders.
Match the Verification Channel to Your Market
The channel you verify through matters as much as when you verify. SMS isn't always the answer, and it's usually the most expensive option.
A layered approach works better. Start with the lowest-friction method and fall back only when you need to:
- Silent network checks first — confirm the number in the background, with no code for the customer to type, where it's supported.
- WhatsApp OTP next — in WhatsApp-dense markets across MENA, South Asia, and Latin America, customers see it instantly.
- SMS as the universal fallback — reliable almost everywhere, so it catches whatever the first two miss.
Merchants running this kind of layered verification clear more than 95% of attempts while cutting verification cost 30–60% compared with sending an SMS to every order.
Verify at the Moment That Prevents the Return
Catching a fake order is only half the job. The other half is confirming the real ones before they bounce back to you.
Two checkpoints do most of the work: a check when the order is placed, and a quick confirmation before the courier heads out. The follow-up matters more than people expect. Reaching customers within about five minutes of an order has been shown to drop RTO from the 30–35% range to 18–22%. The order is still fresh in their mind, and a quick "yes, I still want it" costs you nothing.
Measure What Verification Saves, Not Just What It Blocks
Verification has a cost on both sides: the friction it adds for real customers, and the fraud and returns it prevents. Track both so you can tune it instead of guessing.
Watch three numbers — your verification pass rate (how many real customers clear it), your RTO rate on verified versus unverified orders, and conversion on the segments where verification is switched on. Keep in mind what a returned order actually costs: $5 to $10 in logistics alone before the lost margin. A few points of RTO reduction usually pays for the whole system. On Shopify, an app like EasySell bundles OTP over SMS or WhatsApp with rule-based blocking by phone, email, or IP, so you can point verification at the risky orders rather than all of them.
Pick your single biggest risk signal — for most COD stores that's first-time buyers — and turn on verification for just that group this week. Leave everyone else untouched, then compare RTO on that segment against the orders you didn't verify over the next two weeks.
That one move gives you most of the fraud protection of blanket verification without the conversion tax, and it's the whole idea behind risk-based COD verification. Add a second signal only when your own numbers say you need it.