The store received more than one hundred orders in less than a week.
It was not a basic store its owner had thrown together in half an hour, nor was its product page poorly designed or filled with obvious mistakes that would make you suspicious at first sight. Everything looked professional.
The product appeared complete. The brand identity was convincing, the store had been carefully designed, and the photos and videos showed customers exactly what they expected to receive. Even the advertising campaigns were professionally produced and successfully persuaded people to buy.
If you had looked at the dashboard, you would have seen the beginning of an extraordinary success story.
More than one hundred orders in just a few days.
But the success displayed on the screen was only the beginning of one of the worst experiences we faced during my time at YouCan.
Customers began receiving their parcels. They paid the delivery driver, then opened the cardboard box after accepting it.
Inside, they did not find the product they had seen in the photos and videos.
They found packs of salt.
Yes, ordinary salt inside parcels sent by a store designed to look like a professional brand.
The customers tried to contact the store owner, but he did not answer. He blocked them, leaving them with no other way to reach him. Eventually, they found their way to YouCan’s customer support team.
They were angry, and they had every right to be.
They had purchased from a store that looked professional, paid their money, and then discovered that all that professionalism was merely decoration concealing a scam.
But we found ourselves in an extremely complicated position.
YouCan had provided the technology used to create the store, but it was not the seller. We had not selected the product, created the advertisement, packaged the parcels or delivered them to the customers.
Our role was to provide the storefront and the technical tools needed to manage it. But the customer who had lost money could not see those boundaries.
From their perspective, the store had been built on YouCan. So after the owner closed every other door, they came knocking on ours.
That raised a question with no easy answer:
Where does the responsibility of a tool end, and where does the responsibility of the person using it begin?
Before this incident, I believed that a professional-looking store gave customers confidence. Afterwards, I understood that good design could give a scammer the same advantage.
Someone can build an attractive visual identity, produce a convincing advertisement, write a professional product description and use all of it to hide what is actually inside the parcel.
We have learned to rely on certain signals when judging whether an online store is trustworthy: good design, clear images, an organised offer and a page that appears to have been created by a professional team.
But a scammer can imitate every one of those signals.
In a traditional shop, customers can see the seller, the product and the premises. In e-commerce, they are purchasing an image and a promise.
Cash on delivery appears to offer protection because customers do not pay until the parcel arrives. But the arrival of a parcel does not always mean the arrival of the product.
In this case, customers paid before they were able to open the cardboard box and inspect its contents. After handing the money to the delivery driver, they discovered that the promise they had purchased had turned into a pack of salt.
The problem was not only the payment method. It was the belief that cash on delivery had eliminated the risk entirely.
Cash on delivery protects customers from paying before something reaches their door. On its own, however, it cannot guarantee that the item inside the parcel matches what they saw on the screen.
Despite this story, we cannot deny the role cash on delivery played in expanding e-commerce in Morocco.
Many customers were unwilling to enter their bank details on a store they did not recognise. Some did not have a card that could be used for online payments in the first place.
The solution was simple:
Order now and pay when the product arrives.
This model removed a major barrier for buyers and allowed merchants to reach people who were not prepared to pay in advance. Cash on delivery remains an important part of the Moroccan market, alongside digital payment methods that have gradually continued to expand.
But the problem emerged from that same advantage.
A customer can place an order without paying a single dirham. There is not always anything preventing them from changing their mind an hour later, denying that they placed the order, or switching off their phone when the delivery driver calls.
An order appearing on the dashboard is not a sale.
It is only a person saying that they may buy the product when it arrives.
They may not.
An IBM case study about YouCan captured this problem clearly. Because cash on delivery is widely used across African markets, every order entering the store could not be treated as a completed sale.
YouCan therefore developed a system in which an order was first recorded as pending and converted into a completed order only after the product had been delivered and the payment collected.
Put more simply:
The number displayed in front of the merchant is not money in their pocket. It is a promise that may be fulfilled, or may end with an unanswered phone call and a returned parcel.
During the early stages, we did not confirm orders ourselves. Most merchants handled that process on their own. After receiving an order, the merchant called the customer to verify their name, address and intention to buy before sending the parcel to the shipping company.
The confirmation call was an attempt to turn the click of a button into a real commitment.
But even a confirmed order was not a guarantee. A customer might confirm an order in the morning and change their mind that evening. They might not answer the delivery driver’s calls. They might reject the product after it had already reached their city.
In all these situations, the merchant had already paid for packaging and shipping and might also have to pay the cost of returning the parcel.
That is why I saw merchants celebrating their order numbers before knowing how many parcels had actually reached their customers.
One hundred orders do not mean one hundred sales.
Even one hundred confirmed orders do not mean the money is already in the merchant’s pocket.
The real figure appears only after deducting cancelled orders, unanswered calls, rejected parcels, advertising costs, confirmation calls, packaging, shipping and returns.
A screenshot showing revenue alone may conceal a business that loses money with every new order.
The story of the salt packs showed us how a dishonest merchant could exploit cash on delivery to deceive buyers. But we also experienced the opposite side: fake orders being used to harm merchants and the platform itself.
There was a period when we received thousands of fake orders from unknown sources. These were not ordinary orders from customers who were simply not serious. It was a dense and organised wave that placed enormous pressure on the system, merchants and the development team.
At the time, what was happening felt like a cyberwar. It was a difficult period for everyone.
Merchants could no longer tell which orders were genuine and which were fake. They could spend hours calling numbers that did not exist or send parcels to false addresses if they failed to notice the warning signs.
Meanwhile, the support team received complaints and questions as developers tried to identify the source of the orders and stop them without disrupting legitimate purchases.
It was a difficult equation.
Making the ordering process easy opened the door to more fake orders. Adding too many verification barriers risked losing genuine customers who did not want to complete a long process to purchase a simple product.
The answer was neither to close the door nor to leave it completely open.
We had to find a way to let real customers enter without allowing thousands of ghosts to follow them.
I cannot present what happened as a confirmed cyberattack in the technical sense. What we experienced in practice was an organised wave of fake orders that placed real pressure on the platform and its users.
We clearly state in the terms of use that account owners are responsible for the activities and content they place in their stores. But the salt incident taught me that writing the limits of responsibility on a terms page does not automatically make them clear to the person who has been harmed.
Customers do not think about the technical structure behind a transaction. They do not always distinguish between the store owner, the hosting platform, the shipping company and the driver standing at their door.
They know only one thing: they paid and did not receive the product they had been promised. Then they begin searching for any door that has not been closed in their face.
At that point, the platform faces a responsibility that extends beyond providing servers and a store-building page: protecting trust in the ecosystem it is creating, even when it is not the party that sold the product.
If a platform becomes filled with fraudulent stores, customers will not simply blame individual sellers. They will lose trust in the platform, and perhaps in e-commerce as a whole.
Likewise, if online stores become overwhelmed with fake orders, merchants will lose trust in advertising, customers and the wider ecosystem.
Trust does not collapse on only one side.
When a merchant deceives a customer, honest merchants pay part of the price. When people submit fake orders, genuine customers pay part of the price through additional verification calls and stricter purchasing conditions.
Morocco’s Law No. 31.08 provides a framework for consumer protection. It includes the right to clear information, safeguards for distance-selling contracts, and protections relating to defective products, after-sales service and compensation for harm.
But the existence of a law does not mean every customer knows the seller’s real identity, has kept their information, or knows which authority to contact.
The scammer relies on that distance.
They assume the amount is not large enough for the customer to pursue formal procedures. They expect the anger to last for two days and then turn into resignation. They know that one store can disappear and another can emerge under a new name and design.
That is why the phrase “cash on delivery” is not enough to create trust.
Customers need to know the seller’s identity, how to contact them, the store’s return policy, and what they can do if the contents of the parcel do not match the product they ordered.
Merchants also need tools that help them distinguish genuine orders from fake ones, verify customer information, monitor delivery and rejection rates, and avoid blindly shipping everything that appears on their dashboards.
That store remained in my memory because it was professional in every respect except the only one on which commerce is supposed to be built: delivering what the seller had promised.
The photos were professional. The videos were professional. The advertisements were professional. The store design was professional.
Even the deception was professional.
But inside the cardboard box was a pack of salt.
Since that day, I have no longer viewed an attractive store as sufficient evidence of a legitimate business. Nor have I considered the number of orders sufficient proof of a merchant’s success.
Cash on delivery helped build e-commerce in Morocco because it gave customers a sense of security and allowed merchants to sell to an audience that did not pay online.
But it also exposed how fragile the trust between both sides could be.
Sometimes, the merchant deceives the customer.
At other times, the customer is nothing more than a fake order created to harm the merchant.
In both cases, shipping companies, support teams, platforms, honest buyers and legitimate merchants all pay part of the price.
The problem is not whether we pay before or upon delivery.
The problem is that e-commerce cannot continue if every party enters the transaction convinced that the other is trying to deceive them.
That pack of salt left me with a question much larger than the value of the product or the order:
How do we build an e-commerce market in which customers can trust what will arrive, and merchants can trust that the person who clicked the order button actually exists?
That is the real challenge facing cash on delivery in Morocco.
Until we find an answer, every sealed parcel will continue to carry two possibilities:
A product the customer is waiting for…
Or another pack of salt.