A fake order costs the person who places it nothing: an invented name, a phone number typed at random, one tap on “Order”. For a seller paid in cash on delivery, that same order sets off a call, packing, a trip to the customer, usually a trip back, and ties up a product a real buyer could have had. This guide covers where fake orders come from, how to recognise them, how to stop them at each step (the order form, the ad account, the confirmation call), what to do about repeat offenders, and how much Moroccan law lets you keep on them.
What an order that should never have shipped costs
With cash on delivery, the seller pays for everything up front and is paid only at the very end. A payments specialist quoted by Le Matin puts the merchant’s refusal rate at the door between 20 and 40%, with stock tied up and logistics costs doubled. Not every refused parcel is a fake order: some customers changed their mind or were not home. But a fake order that ships always ends in a refusal, and you pay for it twice, out and back.
The damage goes beyond shipping. A fake order takes a real customer’s place in the confirmation queue, distorts your campaign statistics and can drain limited stock for people who will never buy. To put a figure on what one refused parcel takes out of your margin, run your own costs through the COD calculator.
Where fake orders come from
“Fake order” covers several quite different situations. Telling them apart is how you pick the right fix.
- Bots. Scripts fill in forms in bulk, to test numbers, to spam a store or simply because they crawl the web. Google notes that botnets can be programmed to act like real users, which makes their traffic hard to spot.
- Competitors. Google lists fraudulent clicking by competing advertisers among the forms of invalid traffic. A rival can go one step further and place orders so that you pay for pointless shipments.
- Pranksters and the curious. A teenager ordering in a friend’s name, someone who wants to “see what happens”, a shopper who orders three times to compare delivery times.
- Accidental duplicates. A customer taps the button twice, reloads because the thank-you page is slow, or resubmits after the connection drops. Google itself counts the second click of a double-click as invalid; the same reflex produces duplicate orders.
- Scammers. The worst case is not the order that goes unpaid but the order placed to steal. In Tikkiouine, police broke up a gang that posed as customers of appliance shops, then took the goods at delivery and left without paying.
The first four cost you a shipment. The last one costs you the goods. The measures below address both.
The signs that should raise a flag
No single sign proves an order is fake. What matters is how many pile up, and the rule has to be the same for every agent.
| Sign | What it suggests | Suggested response |
|---|---|---|
| Phone number in the wrong format, too short, or one digit repeated | Random typing or a bot | Reject at the form |
| Joke name, insult or a celebrity’s name | A prank | Call before any packing |
| Several orders from the same number within minutes | A duplicate or a test | Merge into one order |
| A burst of orders from one IP address | A bot or a competitor | Temporary block and review |
| Address with no neighbourhood or landmark, or a city you do not deliver to | A careless buyer or a mistake | A precise question on the call |
| Unusual quantity of an expensive product | An attempted scam | Stricter checks |
| The person reached says they ordered nothing | Someone else’s number | Cancel and note it on file |
Record the reason for every cancellation. After a few weeks those reasons show which traffic source produces which kind of fake order, and that is what lets you act further upstream.
First filter: the order form
The form is the cheapest place to stop a fake order, because nobody has spent any time on it yet. A handful of plain rules removes much of the noise.
- Validate the phone number. Moroccan mobiles start with 06 or 07; the ANRT said numbers starting with 07 come in the form 07AB xxxxxx, ten digits in all. Accept the international format too, but refuse anything too short, too long or made of one repeated digit.
- Add an invisible bot check. Tools such as Cloudflare Turnstile work without showing visitors a CAPTCHA, and even offer a completely hidden widget. A human customer sees nothing; the bot is stopped.
- Use a honeypot field. A field hidden from people, which only bots fill in, flags automated submissions without bothering anyone.
- Block double submission. Disable the button after the first tap and automatically merge two identical orders that arrive from the same number within a short window.
- Rate-limit. Several orders from one device or IP address within minutes deserve a temporary hold until someone has looked.
- Show the full price before sending. A customer who sees the final amount, delivery included, before confirming will not be surprised at the door.
Do not ask for more than you need: every extra mandatory field drives genuine buyers away. A name, a phone number, a city and an address with a landmark are enough to deliver.
Second filter: your ad settings
Many fake orders start with an ad. The platforms already filter some traffic: Google says you are not charged for invalid clicks, and you can add an “Invalid clicks” column to campaign reports to see what was removed. But a click the platform accepts can still produce an order with no intent to buy behind it.
- Exclude suspicious IP addresses. Google Ads lets you exclude up to 500 per campaign. If your logs show one address sending orders in series, exclude it.
- Tighten the location targeting. Do not advertise where you do not deliver. An order from a city your carrier does not serve is lost before it starts.
- Pick the right Meta form type. For instant forms, Meta selects “More Volume” by default. The “Higher Intent” type adds a review step before submission: fewer leads, but leads who have reread their details.
- Compare placements and audiences. A campaign that brings lots of cheap orders and a high share of “wrong number” or “ordered nothing” cancellations costs more than it seems. Judge each campaign on delivered orders, not on orders received.
Third filter: confirmation before shipping
Nothing ships unconfirmed. That rule protects you best, because it makes a real person talk to another real person. To expose a fake order, the call should get the customer talking rather than ask for a bare “yes”:
- Ask them to say what they ordered instead of reading it out to them. Someone who ordered nothing hesitates.
- Have them spell out the address: neighbourhood, street, a well-known landmark. A real customer knows their own door; a prankster makes one up.
- State the total price and the delivery time, and wait for a clear answer.
- If the person says they ordered nothing, do not argue: cancel and log the reason.
When the call does not get through, a WhatsApp message leaves a written record and lets the customer answer later. Our guide to raising the confirmation rate covers follow-ups in detail.
For expensive products, add a handover rule: the courier hands the parcel over at the confirmed address, against payment, and never at a meeting point set at the last minute. The Tikkiouine gang set the handover outside the shop or in places picked in advance precisely so they could leave with the goods.
What to do about repeat offenders
Some numbers keep coming back: repeated refusals, fake names, parcels never collected. Treating them like any other customer means paying for the same trip again and again. A graduated response is fairer than an immediate ban.
- First refusal with no reason: a note on file and a more thorough call on the next order.
- Repeated refusals: ask for the delivery fee, or a deposit, in advance before shipping.
- False identity, threats or attempted theft: decline the sale. If it is fraud, file a complaint: in Tikkiouine the investigation began after several matching complaints from merchants.
Always record a verifiable fact (“three parcels refused with no reason given”), never a verdict (“scammer”). The customer may have changed numbers, lent their phone or had their name used by someone else. To follow returning parcels and their cost, see also our guide to cutting the return rate.
Blocklists and law 09-08: what you may keep
A file of customers to avoid is still a file of personal data, subject to law 09-08 and to oversight by the CNDP. Several limits follow directly from the text:
- Declare the processing. Before processing personal data, most controllers must file a declaration with the CNDP.
- Keep only what you need, and not forever. Holding outdated or irrelevant data breaches the duty to hold “adequate, relevant and non-excessive” data. Set a period after which an entry is deleted.
- Let the person answer back. They can ask for wrong information to be corrected and have a right to object on legitimate grounds.
- Do not pool files without authorisation. Interconnecting files is among the processing that needs prior authorisation. A list shared between sellers in a chat group does not fit that frame.
- Do not label anyone a fraudster. The law sets separate rules for files on offences and convictions. Naming someone a crook in a commercial file, with no court ruling, exposes you.
The penalties are real. According to Upsilon Consulting’s summary of the law, article 53 fines anyone who denies a person access, rectification or objection 20,000 to 200,000 dirhams, and article 57 punishes failing to respect the retention period with the same fine plus a prison term. This is not legal advice: when in doubt, ask the CNDP or a lawyer.
Where Cashod fits
Confirmation is still the strongest barrier against fake orders, and that is where Cashod helps. It includes a call center where agents confirm COD orders by phone before they leave. It can also confirm orders over WhatsApp, including with an AI agent, which keeps a written record of the customer’s answer.
Cashod also tracks returned parcels, and each carrier’s delivery and return fees are set per city in it. You see what every refusal really cost you and can trace it back to the campaigns that produce the most orders that go nowhere.
