verify operations through email I need to ensure that the user is the one who is acting on the website by sending hash code generated to his emial or sms message before complete an operation.

we have implemented account balance so we need to prevent others use his balance by verify the account owner.

Scenario wanted to achieve:

User add items to his cart
Send hash code to his email 
verify the code 
Complete to checkout


What is the best practice to achieve?

using commerce framework -- commerce account balance
You should force user registration before checkout and allow Drupal to handle this. There are a couple of things you can do to make it very tough for non-humans to get through:


Require user verification for registration. This is out of the box functionality with Drupal and is accessible in the system configuration area.
Consider using a module such as Captcha or Honeypot to expose traps for bots so that they cannot continue.


Don't work against Drupal's user and form system on this one. Let them do the work for you.