Stopping fake cash-on-delivery orders in Shopify
Make the phone number required, block the numbers and postal areas that keep refusing parcels, and for buyers you are unsure about hide cash on delivery rather than blocking them, so they can still pay upfront. All of this runs in Shopify checkout. If your store takes COD orders through a form app on the product page instead of checkout, checkout rules never see those orders.
Why fake COD orders are expensive
With card payments a bad order costs a fee. With cash on delivery it costs a parcel: the stock is packed and held, the courier is paid to go and to come back, and the item returns days later, sometimes damaged. Repeat refusers and prank orders are a known part of selling COD in many markets, and the cost lands entirely on the store.
1. Make the phone number required
Every other step depends on it. The courier needs the number anyway, and it is the detail a repeat refuser changes least. In Settings > Checkout set Shipping address phone number to Required; Shopify applies it whenever the order has a shipping step.
2. Block the numbers that refused before
When a parcel comes back refused, add that phone number to a checkout block rule. The next attempt with the same number is rejected inside checkout, so no order, no parcel and no courier fee. OrderGate compares numbers by their last ten digits, so the same number typed with or without the country code or a leading zero is still caught.
3. Hide COD instead of blocking when you are unsure
Blocking is the right answer for a number that has refused three parcels. For a new buyer who merely looks risky, blocking loses a real customer. Hiding cash on delivery for them keeps the sale possible: they can still pay by card, and someone who never intended to pay simply leaves.
The same applies to a postal area or city with a high refusal rate: hide COD there with a region rule rather than refusing every buyer in it. In OrderGate, hiding COD is part of the Standard plan.
Where none of this applies: COD form apps
Many stores selling COD use a form app that takes the order on the product page, so the buyer never opens Shopify checkout. How those apps create the order is not documented by Shopify; developers describe it in Shopify's forums as creating the order directly through the Admin API or draft orders. Treat that as reported rather than documented.
What is documented is the consequence: checkout validation does not run for orders created through the order creation API. An order that never passes through checkout is never seen by a checkout rule, from OrderGate or anyone else. If your COD orders come from a form app, the controls have to live in that app; if you move COD back into Shopify checkout, everything above applies.
What does not help
- IP blocking: nothing that runs in checkout can see the buyer's IP address, and storefront-level IP blocks are bypassed by changing networks.
- Cancelling after the fact with Flow: by the time Flow runs, the order exists. That helps your records, not your parcel costs, unless you cancel before shipping.