Cut Fake Orders in WooCommerce: WhatsApp Verification for Cash on Delivery
Cash on delivery (COD) builds trust with shoppers, which is why it is so popular in e-commerce. For the store owner it carries a risk, though: because nothing is paid up front, anyone can place an order with a random or wrong phone number at no cost. The order is packed, shipped, nobody accepts it and the parcel comes back. This article explains how verifying COD orders with WhatsApp works in WooCommerce, what it helps with and what it does not solve. One point up front: this method does not reduce fake orders to zero, it only makes them considerably harder.
What Fake and Empty Orders Really Cost
A COD order that nobody accepts is more than a lost sale. Count all of these together:
- The work of preparing and packing the item
- Shipping fees both ways
- Stock tied up for a while
- Inspecting the returned item and putting it back on the shelf
- Customer service time spent trying to reach the buyer by phone
Not every such order is malicious. Some come from genuine customers who mistyped their number, some from pranksters or competitors. If the phone number is verified, part of these problems is filtered out before the order is even placed.
What WhatsApp Verification Solves, and What It Does Not
Verification proves one thing: the person placing the order can actually reach the number they typed, and has WhatsApp in hand right now. Ordering with mistyped, unused or someone else's numbers becomes harder.
It does not prove that the person will actually accept the parcel. Someone with access to the number can still back out at delivery. So treat verification as a filter rather than a complete answer, and for high-value orders add a further check such as a confirmation call or a minimum basket amount.
The Flow From the Customer's Side
- The customer confirms the cart, types a phone number at checkout and chooses cash on delivery.
- They press the "Send code via WhatsApp" button in the verification box.
- Within seconds a six-digit code arrives from your WhatsApp number.
- They type the code into the form; once verified, the "Place order" button works.
Customers who pay by card do not need to be asked for a code. The plugin can be set to require verification only when cash on delivery is selected, so honest card payers meet no extra friction.
Setting It Up With the Plugin
The WordPress plugin built for WapFlow OTP is compatible with WooCommerce and works with both the classic checkout and the Checkout Block. In short:
- Get a WapFlow OTP subscription, link your own WhatsApp number with a QR code in the panel and create an API key.
- Upload and activate the plugin in WordPress (Plugins, Add New, Upload Plugin).
- Paste the key under Settings, WapFlow OTP and press "Test connection".
- In the "WooCommerce checkout" section, turn on "Require a verified billing phone before the order is placed" and tick "Only for cash on delivery orders".
The payment gateway ids that count as cash on delivery are configurable; by default cod is used. If you use the Checkout Block, make sure the phone field is visible and required in the checkout form; the verification reads the number from that field. The full screen-by-screen walk-through is in our step-by-step installation guide. We suggest trying it with a test key first: a test key sends no WhatsApp message and shows the code to administrators only.
How Is It Kept Secure?
The verification result is never taken on trust from the browser. The plugin keeps the verified phone in a short-lived, single-use record on the server and checks it server-side when the order is completed. Someone who tampers with the checkout page's browser code still cannot pass the server check. A verified order gets an order note and the _wapflow_otp_verified meta, so you can see afterwards which orders were verified.
The send endpoints are protected as well: a page nonce on every send, a limit of 10 requests per 10 minutes per IP, and 1 send per minute and 5 per hour per phone. On public forms, if you want to add a CAPTCHA plugin as well, you can hook into the plugin's wapflow_otp_before_send filter.
Which Setting, When?
| Setting | When it makes sense |
|---|---|
| Only cash on delivery | When the problem is limited to COD; card payers are not affected |
| Only guests | When registered users' numbers were verified earlier |
| Only new customers | When you do not want to bother old, trusted customers |
| All orders | When phone accuracy matters for every payment type |
Pre-Launch Checklist
- Did you switch to the live key? A test key sends no WhatsApp message. If you leave the shop on a test key, customers get no code and cannot order.
- Is your number connected and online? The plugin's "Test connection" button shows your plan, quota and the number of connected numbers. If no number is connected, you will see a warning.
- Is the phone field required? Verification uses the phone number from the checkout form. If the field is hidden or can be left empty, the flow will not work.
- Have you tried your own order? Place a real test order with cash on delivery on the classic checkout and, if you use it, the Checkout Block; also check that card payments are not asked for a code.
- Is your customer-facing message ready? If you put a short note next to the cash on delivery option, such as "For your security we will send a code to your phone via WhatsApp", customers will not find the wait for the code strange.
Quota and Cost
Every code you send counts against your quota. A simple example: if you get around 2,000 COD orders a month and each customer asks for 1.3 codes on average, you need 2,600 codes. The figure is only an illustration; calculate with your own order volume. WapFlow OTP plans start at 249.99 TRY (1 account, 5,000 codes) with no per-message fee; details are on the pricing page. Because the codes travel over WhatsApp, the daily sending limit and warm-up of the number you use matter too; we cover that in our post on reducing ban risk.
Honest Warnings
- WapFlow OTP is not the official WhatsApp Business API; it works through a linked device and does not guarantee delivery.
- A customer may not have WhatsApp, or the message may not arrive. Consider offering these customers an alternative, such as phone confirmation, so they can still order.
- The ban risk is never zero. If the number is restricted, codes stop; linking a second number gives you a safe backup.
- Mention phone verification in your privacy policy. The plugin stores the verification state in short-lived records and the verified number in the user's profile.
Frequently Asked Questions
Can a customer place the order without entering the code?
Not on orders where verification is on. The server-side check does not let an order with an unverified phone be completed.
Does it work with the Checkout Block?
Yes. The server-side check works on the classic checkout and on the Checkout Block. The verification box is added to the classic page automatically; for the Block it is placed just above the "Place order" button with JavaScript. If a theme or a third-party extension changes the markup heavily, the position may need adjusting.
Whose number do the codes come from?
From the WhatsApp number you linked. The customer receives the code from a business chat they recognise.
Can I ask for a code only on cash on delivery?
Yes. With the "Only for cash on delivery orders" option, other payment types are never asked for a code.
What happens when the quota runs out?
The API returns a quota exceeded error and new codes cannot be sent. The plugin shows the customer a clear message. You can follow the quota in the panel and upgrade your plan if needed.
