Experienced Indian Shopify merchants develop an instinct for which COD orders feel wrong. New customer. High cart value. Tier-3 pincode. Generic email address. The instinct is data-informed: these signals individually predict higher RTO risk, and in combination they predict it reliably enough that pre-emptive action is justified.

This guide makes that instinct explicit — the 7 signals that most reliably indicate a high-risk COD order, how to weight them, and how to act on them efficiently at scale.

Signal 1: Destination pincode

Pincode is the single strongest predictor of COD RTO risk. Your 90-day delivery data will show clearly which pincodes have disproportionate RTO rates. The pattern is not random — specific pincodes consistently generate high return volumes across multiple merchants and categories.

High-risk pincode characteristics: dense urban areas in states with high unemployment, areas known for high mobile internet usage with impulse purchasing behaviour, and pincodes where courier access is structurally difficult (industrial areas, gated communities without courier protocols).

Action: Maintain a current block list and add to it monthly based on your data. COD Blocker automates this — blocked pincode customers simply do not see COD at checkout.

Signal 2: New customer with no delivery history

First-time buyers have materially higher COD RTO rates than repeat customers across every product category and geography in India. A customer who has previously ordered from your store and accepted delivery has demonstrated willingness to receive the product. A new customer has not.

The risk differential: for most Indian merchants, first-time buyer COD RTO rates are 2–3× the RTO rate of returning customers. A store with an overall 22% COD RTO rate typically has first-time buyer COD RTO rates of 35–40% and returning customer COD RTO rates of 8–12%.

Action: Consider requiring prepaid for first-time buyers above a certain cart value (₹2,000–₹3,000). This adds a small friction for genuine new buyers — offset it with a prepaid incentive ₹50–75 off to convert them to prepaid rather than abandoning.

Signal 3: Unusually high cart value for COD

The relationship between cart value and COD fraud is not linear. At lower cart values (under ₹800), COD fraud is common but each incident is low-cost. In the ₹800–₹2,500 range, fraud rates are moderate. Above ₹2,500–₹3,000, something interesting happens: genuine buyers in this range are more likely to pay prepaid (they are more considered buyers) while fake orders at this level cost you more per incident.

The effective risk-adjusted loss calculation: a 25% RTO rate on ₹4,000 COD orders costs ₹300 per incident in logistics costs but you also lose the margin on the product temporarily (2–3 weeks stock cycle). On a ₹4,000 order with 40% gross margin, the true economic impact of one RTO is ₹300 logistics + ₹1,600 margin exposure = ₹1,900 per incident.

Action: Set a cart value threshold in COD Blocker above which COD is disabled. ₹3,000 works for most categories. For high-margin categories, lower this threshold to ₹2,000.

Signal 4: Address quality signals

Address quality is a surprisingly strong predictor of COD intent. Customers who place fake COD orders often provide minimal address detail — they do not intend to receive the order so they enter just enough information to pass checkout validation.

Risk signals in address fields:

  • Single-word city entry (city field left with just "delhi" or "mumbai" with no area)
  • House number that is clearly placeholder ("1" or "123" or "abc")
  • Address line 1 is identical to city (both say "Jaipur")
  • Pincode that does not match the city entered

Action: City Dropdown forces valid city entry from a dropdown, eliminating the city-mismatch signal. For house number quality, make the field mandatory and add a minimum character requirement.

Signal 5: Phone number patterns

Genuine customers provide their actual mobile number because they need to receive delivery confirmation calls and OTPs. Customers placing fake orders sometimes provide non-functional numbers.

Risk indicators: numbers that start with unusual prefixes (valid Indian mobile numbers start with 6, 7, 8 or 9), numbers with obvious sequential patterns (9876543210), numbers that are all the same digit (9999999999). These are rare but clear indicators when present.

Action: Add phone number format validation at checkout. Shopify's checkout allows basic format validation for the phone field.

Signal 6: Email address quality

Customers placing fake orders often use disposable or random email addresses. The pattern: random character strings before the @ symbol, domains from known temporary email providers (mailinator, guerrillamail, yopmail), or email addresses where the name bears no resemblance to the shipping name.

Action: Block email domains from known disposable providers. Several Shopify apps provide this functionality, or it can be implemented via Shopify Flow on Shopify plan and above.

Signal 7: Order velocity from same contact details

Multiple COD orders placed rapidly from the same phone number, email, or shipping address are a strong fraud signal. A genuine customer placing three orders in 10 minutes for different products at different quantities suggests testing or systematic fake ordering.

Action: COD Blocker's velocity rules can flag or block COD for customers who have placed multiple orders in a short window. Configure this rule carefully — it can affect genuine customers during promotional periods when repeat ordering is more common.

Using signals in combination

Individual signals are probabilistic — any one of them can be present on a genuine order. The real predictive power is in combinations. An order that triggers 3 or more of the signals above has a very high probability of resulting in RTO.

A practical manual review threshold: hold COD orders that combine (a) tier-3 pincode + (b) first-time buyer + (c) cart above ₹2,500 for a brief manual review or pre-dispatch SMS confirmation before shipping. The 60 seconds of review time on these specific orders can prevent ₹300–₹500 in per-incident losses.

For automation at scale, COD Blocker handles pincode, cart value and customer history signals automatically at checkout — preventing the order from being placed rather than reviewing it after the fact. This is more efficient and more effective than post-order review.