Commerce Graph · Research Note · Guide

Order Risk Scoring

A practical guide to building and using order risk scores that help Indian sellers catch fraudulent orders, reduce COD defaults, and validate addresses before dispatch.

AS OF 11 JUL 2026 · SOURCE: COMMERCE GRAPH — SHIPROCKET COMMERCE INTELLIGENCE

Key takeaways

Order risk scoring assigns a numeric score to each incoming order based on signals like address quality, payment mode, customer history, and behavioural patterns, enabling sellers to act before dispatch rather than after delivery failure.
Cash-on-delivery orders carry structurally higher risk than prepaid orders because the payment obligation is deferred to the point of delivery, making customer intent the only safeguard against return-to-origin losses.
Address signals — including incomplete pin codes, mismatched city-state pairs, and unserviceable locality names — are among the earliest and most actionable fraud and RTO indicators available without any third-party data.
A risk score template typically combines three to five signal categories, each weighted by its historical predictive power, into a single composite score that routes orders to action buckets such as confirm, verify, or cancel.
Common scoring mistakes include over-indexing on a single signal like COD mode alone, ignoring new-customer-versus-repeat-customer context, and failing to recalibrate weights as order patterns shift seasonally.
Sellers who operationalise risk scoring at the order-intake stage consistently reduce wasted fulfilment costs — packaging, courier fees, and reverse logistics — compared to those who review flags only after a delivery attempt fails.

Every order that enters an Indian e-commerce seller's pipeline carries a hidden probability of failure — not just a logistics problem but a financial one. Return-to-origin shipments, fraudulent address submissions, and cash-on-delivery defaults each erode margin in ways that aggregate reporting masks at the individual order level. Order risk scoring makes that hidden probability visible before a single rupee of fulfilment cost is committed.

The discipline draws on a structured set of signals — customer history, address completeness, payment mode, device and session behaviour, and order composition — and converts them into a single actionable number. For Indian sellers, where COD still dominates large swathes of tier-2 and tier-3 demand, and where address infrastructure remains inconsistent, a well-calibrated risk score is not a nice-to-have feature but a core operational control.

What Is Order Risk Scoring and How Does It Work

Order risk scoring is the process of evaluating every incoming order against a predefined set of risk signals and producing a composite numeric score that indicates the likelihood of a negative outcome — fraud, delivery failure, or payment default. Unlike a binary fraud flag, a score gives sellers a graduated view: low-risk orders flow straight to fulfillment, medium-risk orders are routed for manual review or automated verification calls, and high-risk orders are held or cancelled.

The mechanics follow a consistent pattern. First, a seller or platform identifies the signal categories that best predict failure in their specific catalog and customer geography. Second, each signal is assigned a weight proportional to its predictive value. Third, signals are scored at order intake and summed into a composite. Fourth, the composite is mapped to an action bucket — typically a three-tier system of approve, verify, and reject.

What makes this powerful for Indian e-commerce is the timing. Acting at order intake, before pick-up is scheduled and before packaging begins, means the cost of a wrong decision is near zero. Acting after a delivery attempt fails means absorbing courier fees, packaging costs, and reverse logistics on every rejected shipment. The score is essentially a tool that moves the intervention point as early in the fulfillment chain as possible.

The Core Signal Categories: Fraud, COD, and Address

Three signal families dominate order risk scoring for Indian sellers, and understanding each separately before combining them is essential to building a well-calibrated model.

Fraud signals relate to identity inconsistency and behavioural anomalies. Multiple orders placed to different addresses from the same phone number, orders placed within seconds of account creation, unusually high order values for a first-time buyer, and mismatched name-phone combinations are all classic fraud indicators. These signals are especially relevant for high-value categories like electronics, premium apparel, and jewellery.

COD-specific signals capture intent-to-pay risk. A customer who has previously accepted COD deliveries has demonstrated willingness to complete the transaction. A new customer ordering a high-value item on COD with no prior purchase history is a structurally different risk profile. Order frequency, cancellation history, and whether the customer has ever converted a COD order to prepaid on re-order all carry predictive weight.

Address signals are the most underused category in most Indian seller workflows. A complete, parseable address with a valid pin code, a correctly matched district-state pair, and a serviceable locality name is a low-risk address signal. Incomplete house numbers, generic locality names like 'near market,' unrecognised pin codes, or a pin code that contradicts the stated city are high-risk flags that correlate strongly with both intentional fraud and unintentional delivery failure. Address quality is actionable without any customer history at all, making it particularly valuable for new customer orders.

Building a Risk Score Template: A Step-by-Step Framework

A practical order risk scoring template need not be complex to be effective. The goal is a reproducible process that any ops team member can apply consistently, or that can be configured inside an OMS or shipping platform.

Step 1 — Define your signal set. Choose three to five signal categories relevant to your catalog. A fashion seller prioritises address quality and COD history; an electronics seller adds device fingerprinting and order-value anomaly detection.

Step 2 — Assign point values. Allocate points for each signal based on its estimated impact. A high-risk address might contribute the largest share of points; a new customer on COD a moderate share; a mismatch between billing and delivery phone numbers a smaller share. Keep total points on a round scale — 100 is conventional — for easy interpretation.

Step 3 — Define action thresholds. Establish score bands: for example, low risk routes to automatic approval, medium risk triggers an IVR or agent verification call, and high risk initiates a prepaid conversion request or cancellation.

Step 4 — Log and review. Record the score assigned to every order and the actual outcome. After a meaningful sample period, compare score bands to actual RTO and fraud rates. Signals that don't correlate with outcomes should be downweighted; signals that consistently predict failure should be upweighted.

Step 5 — Recalibrate seasonally. Festive seasons, new geographies, and catalog expansions all shift baseline risk. A static template built for January conditions may underperform significantly during a sale event in October.

Reading Address Signals: The Most Underused Risk Dimension

Address quality is simultaneously the most available and most neglected risk signal in Indian e-commerce operations. Unlike customer behavioural history, which requires prior transaction data, address signals are present in every order from the moment a customer completes checkout.

The key dimensions of address risk assessment are completeness, parsability, and geographic consistency. Completeness means the address contains a house or flat number, a street or locality name, a city, a state, and a valid six-digit pin code. Parsability means the address can be matched to a known delivery geography by a courier system. Geographic consistency means the stated city, district, and pin code refer to the same physical location.

Failure on any one of these dimensions raises delivery risk. Failure on two or more dimensions — for instance, a missing house number combined with a pin code that doesn't match the stated city — substantially increases both RTO probability and fraud probability simultaneously.

Practically, sellers can implement address scoring with a simple validation layer at checkout or at order-import: flag orders with missing sub-locality information, run pin codes against a serviceable-area master list, and cross-check city-state pairs against a postal reference. This catches a meaningful fraction of problematic orders with no customer history required and no machine-learning infrastructure needed — making it the right starting point for sellers building their first scoring capability.

Common Mistakes in Order Risk Scoring and How to Avoid Them

The most frequent error Indian sellers make is treating COD mode as a proxy for all risk. COD is a meaningful signal, but collapsing the entire risk framework into 'COD equals risky, prepaid equals safe' ignores the fact that fraud also occurs on prepaid orders through chargeback manipulation, and that millions of COD orders are fulfilled perfectly every day. Overweighting a single signal degrades score accuracy and leads to excessive false positives — legitimate customers incorrectly flagged and lost.

A second common mistake is ignoring repeat-customer context. A customer who has completed ten COD orders without incident is not the same risk profile as a first-time buyer regardless of payment mode. Scoring systems that don't segment by customer lifecycle produce noisy scores that prompt unnecessary verification friction for loyal buyers.

Third, many sellers build a scoring template and then never recalibrate it. Risk patterns shift — new fraud vectors emerge, courier serviceability changes, and customer behaviour evolves across seasons. A template that isn't periodically reviewed against actual outcome data becomes progressively less accurate.

Fourth, sellers sometimes score in isolation from operations. A risk score is only valuable if it connects to a clear workflow. If the medium-risk bucket triggers a verification call but there is no agent available to make that call within a defined window, the score has no operational effect. Scoring design must be built alongside the operational capacity to act on each tier's required response.

Operationalising Risk Scores: From Template to Daily Practice

Translating a risk scoring framework from a document into a daily operational habit requires three things: integration into the order management workflow, clear ownership, and a feedback loop.

Integration means the score is computed and visible at the moment an ops team member or automated system makes the first fulfilment decision. A score buried in a separate report that no one checks before dispatch provides no value. The ideal integration surfaces the score — and the primary signals driving it — directly in the interface where pick-and-pack or manifest decisions are made.

Ownership means a specific person or team is responsible for acting on each risk tier. High-risk orders need a defined escalation path. Medium-risk orders need a defined verification SLA. Without named ownership, scores become advisory noise rather than operational controls.

The feedback loop is the mechanism that keeps the scoring system accurate over time. Every order that was scored and then resulted in an RTO, a fraud complaint, or a successful delivery contributes a data point. Reviewing this data monthly — even in a simple spreadsheet comparing score bands to actual outcomes — allows weight adjustments that meaningfully improve accuracy across the next period.

For sellers using a shipping aggregator or OMS platform, many of these elements can be configured rather than built from scratch. The intellectual work is defining which signals matter for your specific catalog and customer base; the operational work is ensuring the score reaches the right person at the right moment in the fulfillment chain.

Methodology

Figures reflect orders on the Shiprocket network over the trailing 30 days unless a period is stated. Order-volume figures are indexed to the leading city within each tier (= 100), not absolute counts. AOV, RTO and prepaid share are tier averages. Any current, incomplete month is excluded from trend charts. Data via the Commerce Graph over Shiprocket’s Sense APIs.

Frequently asked questions

What is an order risk scoring template and how do I create one for my e-commerce business?

An order risk scoring template is a structured document or system configuration that lists your chosen risk signals, assigns point values to each, and maps composite scores to specific actions like approve, verify, or cancel. To create one, identify the three to five signals most predictive of failure in your category — typically address quality, COD history, customer tenure, and order-value anomaly — assign weighted points summing to a round total like 100, define score-band thresholds for each action tier, and document the operational response required at each tier. Review outcomes monthly and adjust weights accordingly.

What are the most important fraud signals to include in an order risk score for Indian sellers?

The most important fraud signals for Indian sellers are: a new account placing a high-value first order on COD; multiple orders to different delivery addresses from the same phone number or device; an address that fails basic completeness or geographic consistency checks; a name-phone combination that doesn't match prior records; and orders placed within seconds of account creation. High-value categories like electronics and premium fashion warrant additional signals such as device fingerprinting or IP-geolocation mismatch relative to the delivery address.

How does COD risk differ from fraud risk in order scoring?

COD risk and fraud risk are related but distinct. COD risk is the probability that a genuine customer who intended to purchase will refuse delivery or be unreachable, resulting in a return-to-origin shipment. Fraud risk is the probability that the order was placed with deliberate deceptive intent — a false address, a stolen identity, or a no-intent-to-pay scheme. A scoring system should treat these as separate signal categories with separate weights, because the optimal response differs: COD risk is often best addressed by a verification call, while fraud risk may warrant order cancellation.

Can order risk scoring be done without machine learning or expensive software?

Yes. A rule-based scoring system using a weighted checklist of signals implemented in a spreadsheet or basic OMS configuration is entirely effective for most Indian sellers, particularly those at early to mid scale. Machine learning adds value when order volumes are high enough to generate statistically meaningful outcome samples and when signal complexity exceeds what manual rules can capture. For most sellers, a well-designed five-signal weighted template reviewed and recalibrated monthly outperforms a sophisticated model that is never updated.

How should I use address signals to reduce RTO before dispatch?

Implement an address validation layer at checkout or order import that checks three things: completeness (house number, locality, city, state, and pin code all present), serviceability (pin code appears in your courier's serviceable-area list), and geographic consistency (pin code matches the stated city and state). Orders failing two or more of these checks should enter a verification queue before dispatch. This approach catches a significant proportion of high-RTO orders without requiring any customer history, making it the most accessible starting point for sellers new to risk scoring.

What action should I take for medium-risk orders — hold, call, or cancel?

For medium-risk orders, the standard best practice is an IVR or agent verification call to confirm the customer's intent and validate the delivery address before dispatch. Immediate cancellation is too aggressive for medium-risk scores and forfeits genuine revenue; blind approval ignores the signal entirely. If the customer confirms the order and the address validates verbally, proceed to fulfillment. If the customer is unreachable after a defined number of attempts within a set window, escalate to the high-risk protocol, which may include a prepaid conversion request or cancellation.

How often should I recalibrate my order risk score weights?

Recalibrate at minimum once per quarter under stable conditions, and immediately following any significant change in your business — a new product category, expansion into new geographies, a major sale event, or a noticeable shift in your RTO or fraud rate. The recalibration process is straightforward: compare the score band each order received against its actual outcome, identify signals that predicted failure accurately versus those that didn't, and adjust weights proportionally. Even a simple monthly spreadsheet review of score-versus-outcome significantly improves model accuracy over time.

Is order risk scoring relevant for prepaid orders, or only for COD?

Order risk scoring is relevant for all payment modes. While COD orders carry a structurally different risk profile because payment is deferred, prepaid orders are not immune to fraud — chargebacks, payment credential misuse, and warehouse-level fraud on high-value items all occur on prepaid transactions. Address signals and behavioural anomalies apply equally regardless of payment mode. A scoring system scoped only to COD orders leaves a meaningful fraction of total order risk unaddressed and gives sellers a false sense of security on their prepaid pipeline.

People also search for

Order risk scoring ecommerce templateOrder risk scoring ecommerce pptOrder risk scoring ecommerce pdfOrder risk scoring ecommerce example