Audit a prospect’s email and SMS without a Klaviyo login

To audit a prospect’s email and SMS without a Klaviyo login, sign up to their store as a new customer from an address and phone number that have never bought, then record every email and text for 48 hours with its time and Gmail tab. Send the owner the email itself and its time, and keep the inside flow audit for after the yes.

In July 2026 Laryssa Wirstiuk of Joy Joya signed up to 362 ecommerce brands with fresh email addresses and phone numbers, and logged what arrived. She had no access to any brand’s dashboards. 158 never sent a welcome email, 53 never sent the text they promised, and 20 sent an offer that didn’t match the pop up (Joy Joya, July 2026).

Any agency can run that test on a prospect before it says a word. Few do, because the free audit every agency offers starts inside the brand’s account. Flowium’s audit page says a full audit of a Klaviyo account needs Manager access, and gives 2 to 5 business days. So the owner sees what you found only after agreeing to a call, and your offer sits in the inbox beside every other agency’s free audit.

The rule for the outside half is short: report what arrived, when it arrived and where it landed, never why. A new customer can see all three in 48 hours with nothing to hand over. The inside audit, which can see why, becomes the second step after the yes.

How to run a Klaviyo flow audit from outside, as a new customer

Klaviyo’s own audit guides work inside the account. Its Academy lesson starts from the flow performance report and the benchmarks page, and its March 2026 checklist starts from analytics. Both confirm which core flows are live. A new customer can test that, and what the flows send, without being let in.

Set up customers the prospect has never met

• 4 new Gmail addresses, named for your agency so the owner recognises one in their list: welcome, basket, checkout and a control. Gmail shows you the tab each email lands in.
• 1 phone number that can receive texts and has never opted in to the brand.
• A private window on a phone, in the country the store sells to.
• A sheet: the step, the time, what arrived and when, the tab and a screenshot.
• A rule, written first. For example, a welcome email in 15 minutes with the code the pop up promised. Joy Joya’s checklist asks for 5 to 15 minutes. Klaviyo’s checklist suggests a first basket reminder 30 to 45 minutes after the basket is left.

Use only the public paths any customer has: the pop up, the footer form, the text opt in, the basket and the checkout page. Nothing here needs a made up identity, a contact form or a call.

The pop up, on a phone

Wait for the pop up as a visitor would, then enter the first address and, if it asks, the phone number. Screenshot the offer word for word, with the clock. Record: the offer, when the pop up appeared and whether the form submitted on a phone. No pop up is a finding too: 44 of Joy Joya’s 362 brands had no real way to sign up beyond a small footer form.

The welcome email and its code

Write down the minutes from submit to inbox and set the offer beside the pop up’s. In Joy Joya’s test, 20 brands sent an offer that didn’t match, such as 15% off in the pop up and 10% in the email. Try the code in a basket on a phone. Note the tab. Gmail Help describes Promotions as the tab for deals and offers: it sits in the inbox, not in spam, so record it and don’t call it a fault.

The text opt in

Record whether a confirmation text arrives, what it promises, and each text after it with its time. 53 of Joy Joya’s 362 brands, 14.6%, never sent the text they promised. Reply STOP when the window ends and check the texts stop. Consent and quiet hours rules differ by country and by US state, and this isn’t legal advice.

A basket left behind

On the basket address, add 1 product and leave. Record when a reminder arrives and whether it shows the product’s name, photo and price. A basket you leave appears in the store’s numbers as one more basket, so don’t buy, and never use payment details.

A checkout, stopped before paying

On the checkout address, reach the checkout page, enter the address and stop before payment. Record whether 1 reminder arrives, 2 or none. Keep this address apart from the basket one: Klaviyo’s checklist tells the basket flow to exclude anyone who started checkout, so one address doing both would blur which flow sent what.

The 48 hours, with a control and the spam folder checked

Watch the inboxes and the phone for 48 hours, and look in the spam folder each time. The control is the fourth address, signed up through the footer form in the same minute as the pop up. If the footer address gets a welcome and the pop up address doesn’t, the pop up is where it breaks. If neither does, the break isn’t the pop up alone, and you still can’t say where. A gap counts only once the sign up is confirmed, the spam folder is checked and the whole window is watched.

Turn the 48 hours into one page and a first line the owner can check

The owner can repeat this in a minute, because it is what they do when a flow looks wrong.

Keep the page to what they can check on their own phone:

1. The finding, in 1 sentence with a time in it. Signed up at 09:02 on Monday; the welcome email arrived at 14:37.
2. The email itself, as it arrived, forwarded or saved with the time it came. A screenshot starts an argument. The email settles it.
3. The pop up’s promise beside the email’s offer.
4. The owner’s sum, left blank for them. New sign ups last month, times the share of welcome email recipients who place an order (their flow report has it), times their average order, halved. You can’t see those figures from outside. The owner can, in a minute, and that is the reason to ask for the login.

Halve the sum on purpose, so it stays low enough to be true. If the break is only in the pop up, count only the sign ups that came through it.

The September store check shows the shape. On Tuesday 22 September a test customer left a £40 Body Care Gift Set in a UK skincare store’s basket at 02:57, and another stopped at checkout with a £21 deodorant at 03:11. In the 48 hours that followed, no email reached either inbox (the sample output). It was 4 test customers, 1 inbox each, one store and one run, so it reports what arrived and not why.

Open the message with the one that fits. Send it to the owner or the head of ecommerce from your own address, and say who you are: they will see your address in their list. Check again the day before any call: a gap that has closed is no longer a pitch.

What one inbox can’t prove, so don’t claim it

• “Your flow is switched off.” You saw no email, not the flow. Klaviyo’s Smart Sending skips a flow email to a profile that got another inside the window, 16 hours by default, and a skipped email isn’t sent later (Klaviyo Help). A silent basket can be a setting, and from outside you can’t tell which.
• “Your emails land in Promotions.” A new address shows 1 inbox’s view. Gmail sorts mail into tabs on its own and learns from the moves each person makes, so a loyal customer’s inbox may sort the same email differently. Report the tab you saw, with the date.
• “Your welcome series is weak.” You saw its first 48 hours.
• “Every customer gets this.” A flow can hold conditional splits, so 2 sign ups can receive different emails.
• “This is what you send.” A December welcome email can carry the holiday offer. Date everything you record.
• “This costs you £X.” Revenue sits in their flow report. Leave the sum to the owner.

How to win ecommerce clients before the first call

Pipeline is the problem agencies name first, and the pitch season runs from December to February.

That 67% is the category, not your agency. The outside audit moves the proof ahead of the call. Sign up on Monday, send the first message on Wednesday, and the owner has something to check on their own phone before deciding whether to talk. Start with prospects that run ads and a sign up pop up. They pay for every subscriber, so a welcome email that never arrives costs money they can already see.

The outside audit earns a call. When a client has already introduced you and a call is booked, skip it and ask for the login.

For a CRO audit on Shopify, the same sign up covers the shopper’s side

CRO and Shopify build agencies run the same steps and read more than email. On the phone, note how the pop up opens and whether it closes, what the basket page shows, and what checkout asks before it lets you leave.

The inside audit is the second step, after the yes

The inside audit reads the flows, filters and delays that explain a gap, and it is where Klaviyo’s lesson and checklist point. One flow audit vendor puts a manual audit at 30 minutes to 2 hours (vendor data, July 2025). The outside audit shows the gap exists, which a dashboard can miss: in Klaviyo’s help, delivery means the recipient’s mail server accepted the message, even if it goes to spam.

After the yes, the first outside record is the baseline. Run the same sign up after each fix and the monthly report becomes a before and after.

Where an email flow audit by hand stops

For 5 prospects, the sheet above is all you need.

• Scale. 40 prospects need 160 addresses created and watched, and 40 sheets of screenshots.
• 1 moment. A pass on Monday says nothing about Friday.
• No history. You see nothing sent before the day you signed up.
• The proof is yours. A screenshot you took is weaker than a record the prospect can open.

Obsession’s AI test customers do the same sign up at any store you name, keep each email as it arrived and say they’re AI when they talk to a person. Each result is a link the prospect can open. The use case page covers it for retention agencies.

Five prospects, signed up on Monday

Pick the 5 stores you most want to win. Sign each one up on Monday morning, write the time beside every step, and read the inboxes on Wednesday. By then you know which have a gap you can name, and those are the owners you write to first. The login comes after they say yes.

Questions