COD OTP Verification on Shopify: Stop Fake Orders Before They're Placed
Why a one-time code before a Cash on Delivery order stops fake and mistyped orders, WhatsApp OTP vs SMS OTP, and how OTP and order confirmation work together on Shopify.
WALoops team
calendar_month
schedule3 min read
In this guide
- COD OTP verification sends a one-time code to the buyer's phone before a Cash on Delivery order is placed. No code, no order.
- It stops fake numbers, mistyped numbers and bot or prank orders, which are a large share of COD returns.
- WhatsApp OTP avoids SMS delays and DLT registration, and most Indian shoppers already have WhatsApp open.
- OTP checks the number. A confirmation message after the order checks the intent. Use both.
Every Shopify store that offers Cash on Delivery gets some orders that were never going to be delivered: a fake number, a friend's prank, a typo in the phone field that means the courier can never reach the buyer. You pay to ship each one and again to get it back. A one-time code before the COD order is placed stops most of them at the cost of a few seconds for genuine buyers.
How COD OTP verification works
- The buyer enters their phone number and chooses Cash on Delivery.
- A 6-digit code is sent to that number on WhatsApp (or SMS).
- The buyer types the code. Only then can the COD order be placed.
- The verified number is saved on the order, so the courier and your confirmation messages reach the right person.
Buyers who pay online usually don't need an OTP, because the payment itself proves intent.
What OTP stops, and what it doesn't
| Problem | OTP stops it? |
|---|---|
| Fake or random phone numbers | Yes |
| Mistyped numbers the courier can't reach | Yes |
| Bots and prank orders | Yes |
| Real buyers who change their mind later | No. Use a confirmation message and partial COD. |
| Wrong delivery address | No. A confirmation that shows the address catches it. |
WhatsApp OTP or SMS OTP?
Both verify the number. For Indian stores, WhatsApp usually works better:
- No DLT registration. SMS in India needs DLT entity, header and template registration. WhatsApp uses a template Meta approves.
- Fewer lost codes. SMS codes are often delayed or filtered by operators; WhatsApp messages arrive in seconds.
- Lower cost at volume. Meta's authentication rate in India is ₹0.115 per message.
The trade-off: a buyer without WhatsApp can't receive the code, so keep another option available for them. The WhatsApp OTP vs SMS OTP guide compares the two in detail.
OTP before the order, confirmation after it
OTP and COD confirmation solve different problems, so the strongest setup uses both:
| OTP at checkout | WhatsApp confirmation after ordering | |
|---|---|---|
| When | Before the order exists | Right after the order is placed |
| Checks | The number is real and belongs to the buyer | The buyer still wants the order, and the address is right |
| Buyer effort | Type a 6-digit code | Tap Confirm or Cancel |
The confirmation message looks like this:
Will OTP lower my conversion rate?
Slightly, and mostly by removing orders you didn't want. Genuine buyers already have their phone in hand when shopping on mobile, and a WhatsApp code arrives while they're still on the page. To keep the drop small:
- Ask for the OTP only for COD, not for prepaid.
- Put the phone and OTP step at the start of checkout, so the verified number also fills in the order.
- Let returning buyers skip the OTP on the same device.
Setting up COD OTP on Shopify
Shopify's own checkout can't ask for an OTP before a COD order, so stores use an app with its own checkout step. The WALoops Shopify COD app includes WhatsApp OTP on the free plan, sent from the WALoops WhatsApp number, so there's no Meta setup. On Starter, WhatsApp COD verification then tags confirmed orders and cancels refused ones in Shopify automatically. For other apps that offer OTP, see the Shopify COD apps comparison. Building your own checkout? The WhatsApp OTP API does the same with two API calls.
