Verifai runs 12 checks on each cash-on-delivery order the moment it lands — phone, email, address, duplicates, IP distance, order history — scores it 0–100, and tags it Verified or Manual Review right on the Shopify order. You only look at the ones that need a human.
Cash-on-delivery is how a large part of the world buys. It's also how a store pays outbound shipping, pays return shipping, loses the sale, and ties up stock — on an order that was never going to be delivered. Most of those orders looked wrong from the first second.
A landline, a VoIP number, a burner that carriers already blocked for SMS pumping, or just 9999999999. The courier can't reach anyone at the door, and the parcel turns around.
A postal code for one city with a street in another. No apartment number. A "Flat 3" with no building. Deliverable to no one, and nobody finds out until the parcel has already travelled.
The same basket twice in an hour. The same phone number behind four different names. A customer whose last two parcels came back. Shopify remembers none of it.
No queue, no polling, no "check back in a minute". Verifai runs its checks in parallel the moment Shopify sends the order and writes its verdict back before the merchant has opened the notification.
Name, phone, email, address, IP and payment method — straight from Shopify's orders/create webhook.
All 12 checks execute in parallel. One check failing can't take the others with it — each one reports for itself.
Verified, Manual Review or Rejected, with a 0–100 score and a plain-English reason on every check.
Straight onto the Shopify order, so it shows up in the filters and workflows you already use.
Most run offline for free. A few can use a paid vendor for a sharper answer — with your own key, never a shared one. And if a key is missing or a vendor is down, the check skips. It never holds an order over Verifai's own plumbing.
Parsed against every country's numbering plan. Catches repeated digits, landlines, VoIP, toll-free and premium lines — none of which a courier can reach at the door.
Carrier and line-type lookup via Twilio or Numverify. Flags numbers carriers have blocked for SMS-pumping abuse — the burner that looks fine on every other field.
Whether the number is registered on WhatsApp — a strong sign a real person is behind it. Shown as a badge on the order; never used to hold one.
One number behind three names or four addresses is a pattern worth a look. Counted from your own store's history, and only yours.
Four tiers, cheapest first: syntax → known typos (gamil.com, with a "did you mean") → a 3,500-domain disposable-mail blocklist with a live fallback → a DNS MX lookup that proves whether the domain accepts mail at all.
Live deliverability via ZeroBounce or Kickbox. Only a definite "no" fails the check — catch-all and unknown domains pass, so a strict vendor never costs you a real customer.
Street, city, postal code, state — and a "too thin" test for the address that technically has all four but reads as "Main Rd".
ZIP, PIN, postcode, CEP — strict format rules for 17 countries, then a lookup against a ~100-country postal table. It knows every name a code goes by, so a code covering twenty delivery offices still matches the city your customer actually typed.
Shopify has no landmark field. Verifai ships a checkout extension that adds one under the address form. "Near" and "opp." don't count. Requires Shopify Plus at checkout; a theme field works elsewhere.
Forty units of one SKU on a first order is a question, not an order. You set the ceiling.
The same basket from the same identity inside your window — 24 hours by default — or three orders from one person in that time.
Self-hosted GeoLite2, so the customer's IP never leaves your infrastructure. A different country is treated as its own case — a gift from abroad isn't "far", it's international.
Two parcels sent and lost. Two cancellations and no delivery. A prior order cancelled as fraud. The one signal that predicts RTO better than anything else.
Every order gets a score from 0 to 100. Every point on it comes from a named rule with a fixed weight — Invalid phone, +40. Duplicate order, +30. Postal-code mismatch, +25. Only the worst factor in each category counts, so one bad field can't be double-charged.
That's the whole point. When a merchant asks in three weeks why order #1042 was held, the answer is in the row — not in a model nobody can explain. Every score change is written to an audit log with what changed and why.
A wrong postal code is usually a typo, not fraud. Click the red field, type the right value, and Verifai checks the correction before it touches the order — it won't let you save a code that still doesn't match the city. Then it writes the fix to the real Shopify order and re-scores it in the same click. No separate "re-verify" step, no round trip to the admin.
Overrides are final. If a person approves or rejects an order, a later re-run records fresh evidence alongside that decision, but never overturns it. Someone looked at it — that outranks any rule.
Shopify has no concept of return-to-origin. An RTO'd order just sits there, fulfilled. Yet "this customer's last two parcels came back" is the single strongest predictor of the next one doing the same — so Verifai builds that history itself, three ways, and reads it on every future order from the same person.
One click on the order — "Delivered" or "Came back". The return is recorded as a strike against that customer's history.
Cancellation and fulfillment webhooks record the outcome automatically. A cancel after dispatch counts like an RTO. A cancel because you were out of stock doesn't count at all — that was you, not them.
Connect Shipway and every shipment is pushed to it on fulfillment. Delivery and RTO status flows back into Verifai — 500+ couriers, no per-courier integration.
Verifai never routes your customers' data through a shared vendor account. Bring your own key for any of these and the matching check gets sharper. Leave it out and the check simply reports itself skipped.
Carrier, line type, and Twilio's SMS-pumping risk signal. A free North-America block lookup runs even with no key.
Live mailbox verification. Results cached 90 days under a hash of the address, never the address itself.
Whapi.Cloud, 2Chat, or a self-hosted checker on your own number — because a shared linked number would be a ban target.
Courier-agnostic tracking. Shipments pushed on fulfillment; delivered / RTO outcomes read back.
IP geolocation, self-hosted from a free MaxMind account. No per-call cost, no third party in the webhook path.
~100 countries of postal codes with coordinates, imported once. The only source of a delivery coordinate — Shopify doesn't geocode.
All 12 checks run in parallel inside Shopify's webhook budget. No background queue means no "verified 20 minutes later".
Same phone, email and address as an order you verified in the last 6 months? Verified instantly, and not a single paid lookup spent.
Eight tags, added and removed additively. A tag Verifai didn't write is yours, and not its to touch. Turn tagging off and it cleans up after itself.
Personal data is purged after 180 days, automatically, every 12 hours. The verdict stays; the person doesn't.
Vendor caches are keyed by SHA-256, so they can never become a second, unpurged copy of a customer's phone or email.
Data request, customer redact, shop redact — implemented, and they deliberately don't swallow errors.
Most order-risk apps hand you a number and a confidence percentage. Ask why and you get a shrug. Verifai is deterministic on purpose.
The offline checks — phone format, email typos, address, postal code, duplicates, history — are free forever. Paid plans add the live vendor lookups and export. Every paid plan starts with 14 days free.
For testing, and for a new store starting out.
Install freeFor a store just getting started with COD verification.
Start trialFor a store past its first few hundred orders a month.
Start trialFor a high-volume store that wants every signal.
Start trialBilled through Shopify. Cancel any time from the Plans page; unused time is prorated.
Manual Review tag and a reason; a strongly bad one gets High-Risk Customer. Fulfilment is still your decision, made from a queue that's sorted so the risky ones are at the top.Install on your store, import your last 60 days, and see what Verifai would have caught.