Here’s a number that should make every D2C founder sit up. COD orders in India run 3 to 5 times higher RTO than prepaid orders. And a big slice of those returns never had a chance of being delivered in the first place. They were fake from the moment someone hit “place order.”
COD fraud in ecommerce is the silent leak in your P&L. You pay forward shipping. You pay return shipping. Your inventory sits blocked in transit for two weeks. And the “customer”? They never intended to pay a rupee.
In this guide, we’ll break down how to detect fake COD orders before they ship, how to identify serial RTO abusers who treat your checkout like a playground, and the exact prevention playbook that high-performing D2C brands use to cut COD fraud without killing COD as a payment option.
Because here’s the thing: COD still drives the majority of ecommerce volume in India. Killing it isn’t an option. Managing it intelligently is.
What Is COD Fraud in Ecommerce?
COD fraud is any cash-on-delivery order placed without a real intent to accept and pay for the product.
Unlike card fraud, there’s no stolen payment instrument involved. That’s exactly what makes it tricky. Nothing “illegal” happens at checkout. The fraud only reveals itself at the doorstep, when the delivery agent gets a refusal, a switched-off phone, or a fake address.
COD fraud shows up in a few common forms:
- Fake orders: placed as pranks, by competitors, or by bots stress-testing your checkout
- Impulse refusals: real people who order at midnight and refuse delivery three days later
- Serial RTO abusers: repeat offenders who habitually order and refuse, sometimes across multiple email IDs using the same phone number
- Address manipulation: deliberately vague or wrong addresses that guarantee a failed delivery
- Competitor sabotage: bulk fake orders designed to drain your shipping budget and block your inventory
The common thread? Every one of these ends in an RTO, and every RTO costs you real money. If you’re new to how returns-to-origin work, start with our explainer on what NDR and RTO mean in ecommerce.
The Real Cost of a Fake COD Order
Let’s do the math most brands avoid doing.
Say you sell a kurta set for ₹1,299. A fake COD order costs you:
- Forward shipping: ₹70 to 90
- Return shipping: reverse logistics typically runs 60 to 80% of the forward charge, so another ₹50 to 70
- COD handling fee: charged by most couriers even on undelivered orders
- Packaging: ₹15 to 30, usually unrecoverable
- Blocked inventory: your product spends 10 to 20 days in transit and can’t be sold to anyone else
- Operations time: NDR follow-ups, warehouse QC on the return, repackaging, restocking
Add it up and a single fake COD order costs ₹150 to 300 in hard cash, plus the hidden cost of blocked working capital. Now multiply that by your monthly RTO count. A brand shipping 5,000 orders a month with a 25% COD RTO rate is burning ₹2 to 4 lakh monthly, and a chunk of that traces directly back to fraud.
That’s not a shipping problem. That’s a margin problem. And it compounds during sale events, when fraudsters know you’re too busy to verify orders manually.
The Two Faces of COD Fraud
Not all COD fraud looks the same, and the fix depends on which type you’re fighting. Broadly, you’re dealing with two profiles.
Face One: Fake Orders
These are orders that were never real. Think of a competitor placing 40 orders to random addresses during your festive sale. Or a prankster ordering to a friend’s address. Or bot traffic exploiting a free-shipping-on-COD offer.
Fake orders tend to cluster. They arrive in bursts, often from newly created accounts, often late at night. Fraud analysis across Indian D2C brands shows that rapid-fire orders (three or more within 60 minutes from a new account) appear in roughly 70% of confirmed fake-order cases.
Face Two: Serial RTO Abusers
This one stings more because these are real people. They browse, they order, and then they simply don’t show up for the delivery. Some do it once out of impulse regret. Serial abusers do it as a habit.
The pattern is recognizable if you’re tracking it: the same phone number with multiple refused deliveries, orders placed across different email IDs but shipping to the same address, or customers who accept one item from a multi-order batch and refuse the rest. Retail fraud research from Signifyd shows serial abuse behavior concentrates heavily in a small percentage of customers. A tiny cohort creates an outsized share of your losses.
The good news? Both faces leave fingerprints. You just need to know where to look.
How to Spot a Fake COD Order Before You Ship
The cheapest fraud to handle is the one you never dispatch. Before an order leaves your warehouse, run it against these red flags.
1. New account, high-value first order. A freshly created account placing a ₹3,000+ COD order with zero browsing history is a classic risk signal. Real first-time buyers usually start small.
2. Rapid-fire ordering. Multiple orders within an hour from the same device, IP, or phone number. Legitimate customers rarely do this.
3. Mismatched details. The name on the order doesn’t match the name pattern of the email. The phone number’s telecom circle doesn’t match the delivery state. Small mismatches, big signal.
4. Vague or incomplete addresses. “Near bus stand” is not an address, it’s a future RTO. Missing house numbers, missing landmarks, or pincodes that don’t match the city are all dispatch-blockers.
5. Late-night impulse windows. Orders placed between 11 PM and 3 AM show roughly double the daytime RTO rate. Not every midnight order is fake, but combined with other flags, timing matters.
6. High-RTO pincode. Every brand should maintain pincode-level RTO history. If a pincode has historically returned 40%+ of COD orders, new orders from it deserve extra verification.
7. Bulk identical SKUs. Five units of the same product going COD to one address is either a genuine reseller or a setup. Verify before you ship.
8. Repeated cancellation history. The same phone number with multiple recent cancellations or refusals across your store. This is your serial abuser fingerprint.
No single flag proves fraud. But stacking matters: industry analysis suggests that orders triggering three or more of these patterns account for over 80% of confirmed fake orders. Build your verification rules around flag combinations, not individual signals.
How to Detect Serial RTO Abusers in Your Order Data
Fake orders are caught at checkout. Serial abusers are caught in your history. Here’s how to mine your own data for them.
Start with phone numbers, not emails. Abusers rotate email addresses freely, but phone numbers are stickier because couriers need them. Group your past six months of RTO orders by phone number. Anyone with two or more refused deliveries in 30 days goes on your watch list.
Map addresses too. Some abusers rotate numbers but keep the delivery address. Normalize addresses (strip punctuation, standardize abbreviations) and group RTOs by address cluster.
Track the accept-some-refuse-some pattern. Customers who split orders and consistently accept only part of them are gaming your COD terms. Your OMS data will show this if you look.
Score customers, not just orders. The most effective approach is a rolling customer trust score built from delivery history: successful deliveries raise it, refusals and fake-address incidents lower it. Brands using trust-score-based COD gating have reported 20%+ drops in COD RTO without hurting genuine buyers.
One warning here: distinguish abusers from victims of bad delivery. Sometimes an “RTO abuser” is actually a customer whose courier never attempted delivery and marked it refused. Before blacklisting anyone, check whether the courier’s claim holds up. We’ve covered this exact problem in our guide to handling fake delivery attempts. Punishing a customer for a courier’s laziness is how you lose good buyers forever.
9 Proven Ways to Prevent COD Fraud
Detection tells you who’s risky. Prevention decides what happens next. Here’s the playbook, roughly in order of effort versus impact.
1. Verify COD orders before dispatch
OTP verification via SMS or WhatsApp is the single highest-leverage step. The customer confirms the order with a one-time code, which validates both the phone number and the intent. Brands using OTP or WhatsApp confirmation before dispatch consistently report 30 to 40% drops in COD RTO. IVR calls work as a fallback when messages go unanswered.
2. Validate addresses at checkout
Make house number, street, locality, and pincode mandatory fields. Validate the pincode against your courier serviceability list before accepting the order. Bad address data is the cheapest fraud vector to close, and it improves delivery success for genuine orders too.
3. Tier your pincodes by RTO risk
Score every pincode by historical RTO rate. Low-risk pincodes (under 15% RTO) ship without friction. Medium-risk ones (15 to 25%) require WhatsApp confirmation. High-risk pincodes (above 25%) get COD disabled or capped. This keeps friction proportional to risk.
4. Implement an RTO lock (COD blacklist)
When a customer crosses your refusal threshold (say, two refused COD deliveries in a month), restrict them to prepaid-only checkout. They can still buy from you. They just can’t burn your shipping budget anymore. Most checkout platforms and COD verification apps support phone-number-based blocking.
5. Cap COD order values
Set a maximum COD order value, especially for first-time buyers. A ₹2,500 cap eliminates most high-value fake orders while barely touching genuine demand, since most legitimate high-value buyers are comfortable paying online.
6. Offer partial COD
Collect a small advance (₹50 to 100) online and the balance on delivery. Even a token payment filters out nearly all zero-intent orders, because fraudsters won’t pay anything upfront. It’s the middle path between full COD and full prepaid.
7. Convert COD to prepaid actively
Every COD order converted to prepaid is a fraud risk eliminated entirely. Small prepaid discounts, UPI-on-delivery options, and post-order conversion nudges via WhatsApp all work. We’ve written a full playbook on converting COD orders to prepaid.
8. Use AI risk scoring at checkout
Modern fraud tools score every order in real time using device fingerprints, order velocity, address quality, and historical behavior. High-risk orders route to verification queues instead of dispatch. If you’re on Shopify or WooCommerce, plug-and-play options exist; larger brands can build scoring into their OMS.
9. Ship risky orders on the right courier
Fraud prevention doesn’t end at dispatch. First-attempt delivery success varies widely by courier and region, and a strong first attempt closes the window for refusals. Use smart courier allocation to route COD orders through the courier with the best delivery record for that specific pincode.
Building Your COD Fraud Prevention Workflow
Individual tactics are good. A workflow is better. Here’s how the pieces fit together for a typical D2C brand:
Step 1: Checkout. Address validation runs live. Pincode gets checked against your risk tiers. Obvious junk gets blocked before it becomes an order.
Step 2: Post-order screening. Every order gets a risk score within minutes. Clean orders flow straight to fulfillment. Flagged orders enter a verification queue.
Step 3: Verification. Flagged orders get a WhatsApp confirmation or OTP request. No response in 24 hours? Try an IVR call. Still nothing? Cancel and release the inventory.
Step 4: Dispatch. Verified COD orders route to the courier with the best first-attempt record for that lane. Delivery success is fraud prevention’s last mile.
Step 5: Feedback loop. Every RTO feeds back into your data. Phone numbers, addresses, and pincodes update their scores. Serial offenders hit the RTO lock automatically.
The whole loop can run with near-zero manual effort once set up. The brands that struggle are the ones doing this in spreadsheets, three weeks after the damage is done.
Is It Legal to Block Customers from COD in India?
Short answer: yes. COD is a payment convenience you offer, not a right the customer holds. You’re free to restrict payment options for specific customers based on their transaction history, just as banks decline cards based on risk.
What you should avoid is blocking based on anything other than behavior. Restrict COD because of refusal history, not demographics or location alone. Keep prepaid available so the customer can still purchase. And keep records of the delivery refusals that triggered the block, in case a dispute ever surfaces.
Consumer awareness bodies like Bajaj Finserv’s COD scam guide also remind us that fraud runs both ways: customers get scammed by fake COD parcels too. Clean, verified COD processes protect both sides.
Metrics That Tell You It’s Working
You can’t manage what you don’t measure. Track these five numbers monthly:
- COD RTO rate: RTO orders ÷ shipped COD orders × 100. Your headline number.
- Verification response rate: what percentage of flagged orders confirm via OTP or WhatsApp.
- Fraud catch rate: cancelled-before-dispatch orders that would likely have been RTOs.
- First-attempt delivery rate: the delivery-side twin of fraud prevention. Our FADR guide explains why it moves RTO more than almost anything else.
- False positive rate: genuine customers blocked or delayed by your rules. Keep this low, or fraud prevention starts costing you sales.
A healthy COD program in India should target an RTO rate under 15%. If you’re above 25%, fraud and verification gaps are almost certainly part of the story.
The Bottom Line
COD fraud isn’t a cost of doing business. It’s a process gap, and process gaps can be closed.
Recap the playbook: know the two faces of fraud (fake orders and serial abusers), catch fake orders with stacked red-flag rules before dispatch, mine your own data for repeat offenders, verify risky orders via OTP and WhatsApp, tier your pincodes, cap and convert COD where it makes sense, and route every order through the courier most likely to deliver it on the first attempt.
Each tactic on its own trims a few percentage points. Together, they routinely cut COD RTO by a third or more. On thousands of monthly orders, that’s lakhs back in your pocket every quarter.
Ready to stop shipping money to fraudsters? Metaport’s intelligent shipping platform brings risk-aware courier allocation, NDR automation, and pincode-level performance data into one dashboard. Book a demo and see how much your COD fraud is actually costing you.
FAQs
COD fraud is any cash-on-delivery order placed without genuine intent to accept and pay. It includes fake orders, deliberate delivery refusals, address manipulation, and serial RTO abuse. Since no payment happens at checkout, the fraud only surfaces at delivery, after you’ve already paid forward shipping.
Look for stacked red flags: new accounts placing high-value first orders, multiple orders within an hour, mismatched name and phone details, vague addresses, late-night ordering, and high-RTO pincodes. Orders triggering three or more flags should go through OTP or WhatsApp verification before dispatch.
An RTO lock restricts customers with repeated delivery refusals to prepaid-only checkout. Their phone number or address gets flagged in your system, so COD simply doesn’t appear as an option for them. They can still buy from you, but they can no longer generate free-to-them, costly-to-you failed deliveries.
Yes. OTP or WhatsApp confirmation before dispatch validates both the phone number and purchase intent, and brands using it consistently report 30 to 40% reductions in COD RTO. Pair it with address validation and pincode risk tiers for the biggest impact.
No. COD still drives the majority of Indian ecommerce volume, and removing it costs more in lost sales than fraud does. The smarter play is selective COD: verify risky orders, cap order values, offer partial COD, block proven abusers, and actively convert the rest to prepaid.
Kapil Pathak is a Senior Digital Marketing Executive with over five years of experience in the logistics and supply chain industry. He specializes in SEO, SEM, and multi-channel campaign management. He has a strong track record of building strategies that boost brand visibility and generate qualified leads. His work focuses on driving growth for D2C and B2B technology companies through data-driven digital marketing initiatives.
