El CiberCEODE HOY EN DÍA ES

Mystery Shopping · Cliente Incógnito

Your team serves.Does it also protect?

We assess service, privacy, controls, trust

In-person, phone and digital mystery shopping that answers one operational question: do your staff resolve the customer’s request while protecting their information and respecting access controls?

Request a confidential proposal See the methodology ↘
  • Guatemala and abroad
  • Strict confidentiality
  • Experienced team
  • No covert recording by default
30+years of our director’s experience in security, risk and audit across Central America
4channels assessed: in person, phone, messaging and web
4 weeksfrom kickoff to the pilot’s action plan
1 business dayto answer your proposal request

What it is

Mystery shopping with a security focus

Mystery shopping is an assessment in which a trained evaluator poses as a real customer to observe, against criteria agreed in advance, how a request is handled. Our service also measures whether staff protect customer information and use the authorized channel.

Many providers assess courtesy or the buying experience. We add what boards and executives worry about: unnecessary data requests, information exposed at the counter or over the phone, skipped identity checks and procedures staff do not know.

The result is not a stand-alone score: it is organized evidence to decide whether to clarify a procedure, fix a channel or train the team.

Also known as: mystery shopper, secret shopper, mystery customer, service audit, or cliente incógnito.

The blind spot

What gets reported is not always what happens at the counter

Internal reports are prepared by the same team that serves customers, surveys are answered by whoever chooses to, and most unhappy customers leave without complaining. From headquarters, operations look consistent; at the branches, they are not always.

There is also a risk almost nobody measures: the friendly employee who, trying to help, discloses account data, changes a contact number without verification or takes a call they should not. That is where customer service turns into a security incident.

From a surprise visit to a control system

  1. Defined criteria

    Every observation maps to your protocol and agreed controls, not to the evaluator’s impression.

  2. Verifiable evidence

    Forms validated by a second reviewer, with date, time, site, channel and permitted evidence.

  3. Guidance

    We read the results with your team, prioritize fixes and measure again.

Why us

Experience, judgment and discretion

Experienced professionals

Evaluators and consultants with backgrounds in security, risk and customer service, screened for conflicts of interest and calibrated before every field round.

Services in Guatemala and abroad

We have delivered services both locally and outside the country. Scripts, language and logistics are adapted to each market and channel.

Guaranteed confidentiality

Non-disclosure agreements with every evaluator, client identity protected, evidence under restricted custody and deleted at close as agreed.

Evidence for decisions

Each finding separates facts, inferences and pending evidence. A second reviewer validates every form before the report.

Omnichannel

Customers reach you through many channels. We assess them all.

In person

Branches, stores, counters and points of sale: welcome, waiting, advice, closing and documents left in view.

Phone and call center

Response time, script, transfers, identity verification before disclosing information and handling of pretext calls.

WhatsApp, chat and social

Speed and quality of replies, data requested over messaging and links or files sent to the customer.

Web, app and email

Navigation, forms, online requests or purchases, follow-up communications and the official channel indicated.

What we assess

Eleven dimensions: will customers return, and is their data safe?

Customer experience
  • Welcome, treatment and farewell
  • Waiting and response times
  • Compliance with your brand protocol
  • Advice, suggestive selling and cross-selling
  • Handling of complaints, objections and returns
  • Appearance, order and signage of the service point
Protection and control
  • Identity verification before informing or changing data
  • Only necessary data is requested
  • Information exposed on screens, paper or in conversation
  • Response to pretexting and social engineering
  • Referral to the official, authorized channel

Across all of them we measure consistency between sites, channels and time slots: where it fails and where it works, site by site.

Why the usual tools fall short

What other tools won’t show you

Our approach observes the real interaction, with the same criteria across sites and channels, and combines customer experience with data protection.

  1. Satisfaction surveys

    Answered by whoever chooses to; they measure perception, not procedure compliance.

  2. Internal audits

    Staff usually know when they are being watched, and auditors know the operation from the inside.

  3. Complaints

    They arrive late and from a minority; most unhappy customers leave without a word.

  4. Online reviews

    They reflect extreme cases, are not comparable across sites and are not measured against your protocol.

  5. Traditional mystery shopping

    Measures courtesy and sales, but rarely whether information was protected or identity verified.

  6. Technical penetration testing

    Assesses systems and networks; it does not observe the person serving the customer at the counter.

Where it applies

Scenarios by industry

  1. Banks and credit unionsOperations · Channels

    Request to update a registered phone number. We observe guidance, privacy and use of the authorized channel.

  2. Retail and franchisesOperations

    Product return. We review treatment, policy application and data handling on receipts.

  3. TelecommunicationsQuality · Fraud

    SIM replacement inquiry. We verify whether requirements are explained and the customer is sent to the secure process.

  4. Clinics and insurersOperations · Quality

    Admission inquiry. We observe which data is requested and whether third-party information is protected.

  5. Supermarkets and pharmaciesOperations · Commercial

    Product inquiry and card payment. We observe advice, checkout times and how the card and receipt are handled.

  6. Restaurants and fast foodOperations · Brand

    Counter, drive-through or delivery order. We measure times, protocol, suggestive selling and handling of order data.

  7. Gas stations and car dealersCommercial · Service

    Vehicle quote or forecourt service. We assess advice, follow-up and the personal data requested.

  8. Hospitality, services and public sectorTailored

    We design the scenario around the process that concentrates complaints or risk in your organization.

Methodology

Six phases, a verifiable output in each

The design draws on international references —MSPA operating guidance, ESOMAR guidelines for mobile research and the European Banking Authority (EBA) mystery shopping methodology— adapted to each country.

  1. Mandate

    We agree on the decision you need to make, limits, owners and who can stop the exercise. Output: Scope letter and rules of engagement.

  2. Sample

    We select sites, channels and time slots by volume and risk. Output: Coverage matrix, scripts and observable criteria.

  3. Calibration

    We choose evaluators free of conflicts of interest and rehearse the same case with two people to fix ambiguous criteria. Output: Signed confidentiality agreements.

  4. Fieldwork

    Every contact is documented immediately. The exercise stops if real data is exposed or there is operational risk. Output: Observation form per interaction.

  5. Review

    A second reviewer validates forms and consistency. Critical findings are escalated immediately through the agreed channel. Output: Critical alerts and validated forms.

  6. Improvement

    We assign an owner, date and expected evidence per action, and repeat a comparable scenario after 60–90 days. Output: Action plan and second measurement.

How we work

A four-week pilot

Reference format to get started: four sites, eight in-person visits at different times and four authorized remote contacts. Scaled to the size and countries of your operation.

Week 1

Agree

With Operations and Risk we choose sites, a family of scenarios and the critical controls.

You receive: script and sample for approval, privacy rules and an alert contact.

Weeks 2–3

Observe

We run the visits and remote contacts. A second reviewer validates every form.

You receive: validated forms, permitted evidence and immediate alerts on critical incidents.

Week 4

Decide

We present service and control patterns, checked against your current procedure.

You receive: dashboard, executive report and a workshop to assign owners and dates.

What we measure

Clear criteria, honest results

MeetsDoes not meetNot applicableNot observable

Two visits per site detect gaps and show where to expand the sample. They do not replace a statistical ranking or an individual performance decision.

Every interaction records site, channel, date, time slot, scenario and applicable protocol. We assess separately the clarity of service, referral to the official channel, unnecessary data requests and information exposure.

We report numerator and denominator. If identification was required in six interactions and happened in five, the report says 5 of 6, not a percentage without context. A critical incident is escalated even if service was friendly.

Deliverables

What your organization receives

Before fieldwork

Work plan, scripts, coverage matrix and rules of engagement.

During fieldwork

Validated forms per interaction (proposed turnaround: two business days), permitted evidence with date and time, and immediate alerts on critical findings.

At close

Dashboard by site, channel and control with site ranking and round-over-round comparison; committee report; workshop and action plan with owners and dates.

Confidentiality and privacy

Discretion by design

  1. We sign non-disclosure agreements with your organization and with every evaluator. Client identity, sites and results are never disclosed.

  2. The service is scoped without covert recording. If video or audio is required, your legal team reviews the case and we document legal basis, notice or consent, third parties, authorized areas, custody, access and deletion.

  3. We never carry out real transactions or change customer data. If a test requires authentication, your organization provides a test profile and we define the stop point.

  4. If a written procedure is missing, we record it as a design gap before attributing non-compliance to staff.

Who it is for

Mystery shopping is not for everyone

A good fit if you…
  • Suspect service is not the same across your sites or channels.
  • Want to see what actually happens, not only what is reported.
  • Handle customer data and need to know whether staff protect it.
  • Are ready to fix processes and measure again.
Not for you if you…
  • Only want the cheapest evaluation, without analysis.
  • Want to use results to discipline an individual.
  • Do not plan to act on the findings.
  • Need covert recording without legal review.

Engagement options

Choose how to start

1–2 weeks

Spot assessment

One critical scenario in one channel or a few sites —for example, identity verification over the phone— measured in depth.

4 weeks

Pilot

Baseline: four sites, eight visits, four remote contacts, dashboard, report and workshop.

60–90 days later

Follow-up round

Repeats the current scripts to check whether corrections worked.

Pilot + three rounds

Annual program

Quarterly tracking of critical controls and trends by site and channel.

Quotes depend on countries, sites, channels and deliverables. Purchases, overnight stays, sites outside the metro area, recordings and transactions are budgeted and authorized separately.

Request a quote

Investment

A proposal tailored to your operation

Pricing depends on the real scope: we do not quote what you do not need. After the initial meeting we send the scope, sample, timeline and investment in writing, free and with no commitment.

Free proposal

Request a no-obligation proposal
What drives the investment
  • Number of sites and countries
  • Channels to assess
  • Interactions per site and frequency
  • Scenario complexity (with or without a test profile)
  • Deliverables: dashboard, report, workshop and follow-up
  • Separate costs: purchases, travel and sites outside the metro area

After you contact us

From request to kickoff

01

Reply

We contact you within one business day to schedule.

02

30-minute meeting

We understand your operation, the critical process and the decision you need to make.

03

Proposal

Scope, sample, timeline and investment, in writing.

04

Kickoff

We sign confidentiality agreements and week one begins.

FAQ

Questions we often get

What is a mystery shopper?

A trained evaluator who poses as a real customer to observe, against criteria agreed in advance, how a request is handled in a branch, by phone or through digital channels. Facts are recorded immediately on a standardized form.

How is your service different from traditional mystery shopping?

Beyond service quality, we measure whether staff protect customer information, request only necessary data, refer to the authorized channel and respect identity controls. We integrate physical security, cybersecurity and the human factor.

Why not hire evaluators ourselves?

Because the value is in the design, not the visit: observable criteria, sampling, evaluator calibration, independent review, secure evidence handling and an action plan. External evaluators also avoid bias and conflicts of interest.

How do you ensure objectivity?

Scripts and criteria defined before fieldwork, calibration rehearsals between two evaluators, immediate recording of every interaction, review of every form by a second person and reports with numerator and denominator.

We already run surveys and read online reviews. Why this?

Surveys and reviews measure perception and extreme cases. Mystery shopping observes the real interaction against your procedure, with the same criteria at every site, and includes data-protection controls no survey reveals.

How many evaluations do I need?

As a guide: for a diagnostic, two interactions per site and channel at different times; to compare sites, four or more per site per round; to track trends, quarterly rounds with the same scripts. We tailor it in the proposal.

How much does mystery shopping cost?

It depends on sites, channels, frequency, countries and deliverables. We prepare a free proposal after a 30-minute meeting.

Do you work outside Guatemala?

Yes. Our team is experienced and we have delivered services both in Guatemala and abroad. Scripts, language and logistics are adapted to each country.

How do you protect confidentiality?

Through non-disclosure agreements with the client and every evaluator, restricted access to evidence, defined custody and deletion at close as agreed. We never disclose who our clients are.

Do you record visits?

Not by default. The service is designed without covert recording. If your organization needs it, your legal team reviews it and we document legal basis, consent, custody and deletion.

Is mystery shopping legal and ethical in Guatemala?

It is a common quality and market-research practice. We run it responsibly: no real transactions, no access to third-party data, confidential evidence and no covert recording by default. We recommend validating the design with your legal counsel.

How long does a pilot take?

Four weeks from receipt of the agreed protocols and inputs: one week to agree, two to observe and one to present results and the action plan.

Can results be used to evaluate a specific employee?

No. The goal is to find process failures and prioritize fixes. A small sample does not support individual performance decisions.

Does it add work for my team?

Very little. We need one owner to approve scripts and receive alerts, the current protocols and, if applicable, a test profile. We design, run, review and present.

Which industries can use it?

Banks and credit unions, retail and franchises, telecoms, clinics and insurers, hospitality, services and any organization that serves customers and handles sensitive information.

Contact

Let’s talk in confidence

We reply within one business day. In a 30-minute meeting we clarify three points: which process concentrates complaints, at which step identity or information must be protected, and what management would decide if that control were skipped. Use this form for this or any of our other services.

Your request is confidential. Only the team that will answer reads it, and we do not share your data with third parties.

Prefer email? info@elciberceodehoyendia.com

Your details

Related services

Methodological references

International design references and Guatemalan regulations reviewed on October 31, 2026, adapted to each country.