Why OTP verification works on COD (and where it doesn't)

A one-time code is not a fraud check. It proves one narrow thing: that the person at the cart controls the phone number they entered. That is a smaller claim than "this order will be delivered."

It is also, in COD, almost the whole game — because most failed COD orders are not fraud. They are carelessness, ambivalence and typos.

Three failure modes, one filter

The typo. A digit transposed in a hurry. The order ships, the courier calls a number that belongs to nobody, and the parcel comes back. OTP catches this completely: the code never arrives, the customer notices, and the number gets fixed before the order exists.

The impulse. A genuine person, a genuine number, and a decision made in eleven seconds that they have already cooled on by the time the parcel arrives. OTP catches part of this, because it adds a deliberate second step to a decision that was made without one.

The deliberate. Someone ordering with no intention of paying. This is the rarest of the three and the least affected by OTP alone, because a working phone number is trivially available. This is what risk scoring and blacklists are for.

Configuring OTP as though you are fighting the third case, when the first two are where your losses actually are, leads to the wrong settings.

Where merchants get the configuration wrong

Exempting small orders. It feels harmless — why add friction to a ₹400 purchase? But low-value COD is exactly where impulse ordering concentrates, and where the return costs more than the margin. If you are going to exempt anything, exempt returning verified customers, not cheap carts.

Setting the retry limit too low. Two attempts sounds tight and secure. In practice, real customers mistype codes, switch apps, and lose the message under a pile of notifications. Three sends per ten minutes with a thirty-second resend cooldown filters abuse without punishing people who genuinely want to buy from you.

Never turning on skip-for-returning. A customer who verified last month and had the parcel delivered is the best signal you have. Making them do it again is friction with no information behind it.

Treating a drop in orders as a loss. After turning on verification, COD order count falls. It should. The number to watch is delivered orders and net contribution, not gross orders — and those normally move the other way.

What OTP cannot do

It will not fix a wrong address attached to a correct phone number. It will not stop a customer who verifies happily and then refuses the parcel at the door. It will not tell you that a pincode has a 40% failure rate.

Those need address correction, risk scoring and business rules respectively. Verification is the first filter, not the whole system — but it is the one that removes the largest share of your failures for the least configuration.