Cash on delivery orders that never get collected, fake phone numbers on prepaid checkouts, and bot-submitted registrations all share one fix: verify the customer before the order or account gets created, not after. This post compares three real WooCommerce plugins for OTP or email verification at checkout and registration: SMS Alert, which gates cash-on-delivery orders behind an SMS OTP; Blacklist Manager, which blocks known-bad identities and adds free email verification; and Customer Email Verification for WooCommerce, which stops fake accounts at registration. None of them is a universal fix, and each has a specific gap worth knowing before you install it.
Comparison Table
| Plugin | Best For | Price | Last Updated |
|---|---|---|---|
| SMS Alert | Requiring a phone OTP specifically on Cash on Delivery orders | Free plugin, pay-as-you-go SMS credits | September 9, 2026 |
| Blacklist Manager | Blocking repeat offenders by phone, email, or IP plus free checkout email verification | Free, Premium from $169/year | September 23, 2026 |
| Customer Email Verification for WooCommerce | Stopping fake accounts at registration with a clean OTP popup | Free, Pro from $119/year | September 15, 2026 |
SMS Alert
SMS Alert is built around a specific toggle that most WooCommerce SMS plugins bury as one feature among many: OTP verification that applies only to Cash on Delivery orders, leaving prepaid orders to check out normally. A customer who selects COD gets a one-time code sent to the phone number they entered, and the order does not confirm until they type it back in. That single setting is the reason stores run this plugin at all, since the underlying problem, prank COD orders with a made-up phone number, only exists on the COD path in the first place. Beyond that, the plugin also sends order-status SMS to customers and admins, recovers abandoned carts by text, and can require OTP for login and registration too, though those are separate features from the COD gate.
- Price: Free plugin, pay-as-you-go SMS credits from smsalert.co.in (minimum 5,000 credits, 365-day validity)
- Requires: WordPress 4.6+, PHP 5.6+
- Last updated: September 9, 2026
Setup means installing and activating the plugin, then creating a free account at smsalert.co.in, entering that account’s username and password into the plugin’s settings screen, clicking verify, and turning on the OTP-for-COD option. There’s no bundled SMS gateway. Every code sent draws down prepaid credits you buy separately, and the plugin’s own listing frames itself around Indian DLT-compliant SMS specifically, since India’s telecom regulator requires registered sender templates for transactional SMS. If your customers are elsewhere, the plugin still works, but you’re relying on a gateway built with that compliance requirement as the primary use case, so it’s worth sending a handful of test codes to your own phone on your actual carrier before rolling it out to real customers.
Blacklist Manager
Blacklist Manager takes a different angle than SMS Alert: instead of verifying every COD customer up front, it lets you maintain a list of phone numbers, email addresses, IP addresses, and email domains that get blocked automatically, at checkout, at registration, in comments and product reviews, and even on orders created through the WooCommerce REST API. You add an entry once, from the dashboard or straight off a fraudulent order’s admin screen, and every future match gets stopped before it becomes another order you have to cancel and refund. The free version, which the plugin’s own description is careful to call “a complete local protection toolkit, not a Premium trial,” also includes checkout email verification: a one-time code sent to the email address on file before checkout can proceed.
- Price: Free (Core); Premium from $169/year
- Requires: WordPress 6.3+, PHP 7.4+
- Last updated: September 23, 2026
To set it up, activate the plugin, go to Blacklist Manager > Settings and turn on the checks you want, then start adding entries to the Suspects or Blocklist lists as bad orders come in. The plugin supports both WooCommerce’s classic checkout and the newer block-based checkout, plus Contact Form 7, Gravity Forms, and WPForms, so it’s covering more than just the cart. The real limitation is in the name of the feature you might actually be looking for: phone OTP verification is not part of the free Core plugin at all. The free tier verifies email addresses; a phone number typed at checkout is only checked against your blacklist, not confirmed as real. Getting an actual phone OTP out of this plugin means buying Premium and configuring Twilio or TextMagic as the SMS transport yourself.
Customer Email Verification for WooCommerce
Customer Email Verification for WooCommerce, built by Zorem, solves a narrower problem than the other two: an address that doesn’t exist, or that nobody can actually open, should never be able to create a WooCommerce account. When a customer registers, a popup appears immediately asking for the OTP code that was just emailed to them, and the account is only created once they enter it correctly. It’s a clean, single-purpose flow, no blacklist rules, no SMS gateway account, just email-in, code-back, account created. Store owners can customize the popup’s design and copy, resend a missed code, exclude specific roles like administrators from the check, and review or manually verify accounts in bulk from the WordPress Users screen.
- Price: Free (registration only); Pro from $119/year
- Requires: WordPress 5.3+, PHP 7.2+
- Last updated: September 15, 2026
Installing it is a matter of activating the plugin and configuring the flow under WooCommerce > Email Verification. The catch, and it’s a significant one if you’re trying to stop fake orders rather than fake accounts, is stated plainly in the plugin’s own readme: the free version covers registration verification only. WooCommerce’s default checkout allows guest orders with no account at all, and a guest placing an order never sees this plugin’s popup, free or otherwise. Checkout-level and guest verification is a Pro-only feature. If most of your fraudulent orders come through as guest checkouts rather than fake account signups, which is common, this plugin’s free tier won’t touch the problem you actually have.
How to Pick
- If your fraud problem is specifically prank or fake Cash on Delivery orders and you can work with a prepaid SMS gateway, use SMS Alert and turn on OTP for COD orders only.
- If you want a free, no-external-account layer that blocks repeat bad actors by phone, email, or IP across checkout, registration, and even form submissions, use Blacklist Manager, and treat its free email verification as a bonus rather than a phone OTP replacement.
- If your problem is bot or throwaway-email account registrations rather than guest checkout orders, Customer Email Verification for WooCommerce’s free tier solves that specific case cleanly.
- If your store depends on guest checkout and you need phone verification on every order without standing up your own SMS billing relationship, none of these three free tiers gets you there fully, which is where a custom checkout hook built for your exact flow, gating order confirmation on a code sent through your own SMS provider, tends to make more sense than layering two of these plugins on top of each other.
If you’ve already looked at restricting Cash on Delivery by pincode, OTP verification is the natural next layer: pincode restriction stops COD in areas with a bad delivery history, while OTP verification confirms the specific customer placing the order is reachable at all.
FAQ
Does OTP verification work with WooCommerce’s block-based checkout?
Blacklist Manager states explicit support for both classic and block-based checkout. SMS Alert’s abandoned cart recovery feature lists block-checkout compatibility, though its OTP-for-COD gate is worth testing on your specific checkout setup before launch, since block-based checkout customizes the order-confirmation flow more than classic checkout does.
Will any of these stop a fake order placed as a guest, without creating an account?
SMS Alert and Blacklist Manager’s checkout-level checks apply to guest orders. Customer Email Verification for WooCommerce’s free tier does not, since it only verifies accounts at registration; guest checkout verification is a Pro feature.
Is there a free way to add phone OTP verification without paying for SMS credits?
Not among these three. SMS Alert requires prepaid credits from its own gateway, and Blacklist Manager’s phone OTP is Premium-only with a Twilio or TextMagic bill on top of the license. Email OTP, through Blacklist Manager’s free Core checkout verification or Customer Email Verification’s free registration flow, is the free alternative if email is an acceptable identity check for your store.
Can I require OTP only for Cash on Delivery orders and leave prepaid checkout alone?
Yes, that’s SMS Alert’s specific design. Prepaid orders, already backed by a successful payment, skip the OTP step entirely, and only the COD path is gated.
Does OTP verification work outside India?
Blacklist Manager and Customer Email Verification for WooCommerce have no country dependency since they route through checkout logic and standard WooCommerce email respectively. SMS Alert’s SMS delivery is built around India’s DLT compliance requirements specifically; it isn’t restricted to Indian numbers, but test actual delivery on your customers’ carriers before depending on it.
None of these three plugins is a perfect fit if your store’s fraud problem doesn’t match the specific gap each one leaves. If you need phone OTP gating every guest checkout order without taking on a separate SMS billing relationship, that’s a case our Plugin Development team builds directly into the checkout flow, tied to whichever SMS provider you already use.
