SystemMetering & AMI Operations

Energy Theft Detection

Electricity theft detection from AMI data: every meter scored overnight, every point traced to its read or event, and an analyst approves every visit

An estimated $8.4M a year recovered, with 3 in 5 site visits finding theft.

See one case, screen by screen ↓
estimated$8.4Ma year recovered, estimated: $2.1B electricity revenue × about 1% exposed to tampering × 40% recovered — the same as the demo's run rate since March
demo37live bypasses made safe in Q3 — each one a fire and shock hazard removed the day it was found
demo61%of September's site visits found theft — 251 of 412, against 1 in 8 from tamper-alarm lists before go-live
demo1,238,400metersscored overnight — last night's run took 04:10 to 04:52 — with every point of every score traced to its read, event or balance
The problem

Why the energy balance tells you a transformer is losing energy, but not who is taking it

A revenue protection team knows how much energy leaves each distribution transformer and how much its customers are billed. The gap says energy is going missing, never who is taking it: a 50 kVA transformer serves twenty-odd homes and a feeder about two hundred. On Lumina Utilities' Calloway Row, TX-4471 lost 11.1% of its energy in 30 days against 3.2% expected, across 22 meters. Somewhere among them is a bypass, a magnet or a tap before the meter — or nothing at all, just an empty home and a new rooftop solar connection.

So analysts work from tamper-alarm lists, and tamper alarms are mostly noise: covers opened by the utility's own meter crews, battery and comms faults. Before go-live, Lumina's crews found theft on 1 in 8 visits. Every wasted visit is a truck roll paid for, and every bypass missed is a live, unfused connection — a fire and shock hazard to the household and to the crew who eventually opens the meter. The unbilled load also overloads the transformer: TX-4471 peaked at 117% of its rating on 10 October.

typical$89.3Blost to electricity theft worldwide every year
typical1%of a utility's revenue: about what meter tampering puts within reach of recovery
typical$250–$500a truck roll: the cost of every field visit, including the ones that find nothing
Where a revenue protection analyst's week goes, in hoursestimated
By hand40 days
With the solution10 days
  • Working through tamper-alarm lists10 → 1 d
  • Balancing transformers and feeders in spreadsheets6 → 0.5 d
  • Pulling interval reads, voltage and event logs for each suspect8 → 1 d
  • Ruling out move-outs, new solar, meter exchanges and crew work5 → 1 d
  • Planning visits, routes and safety notes5 → 1.5 d
  • Reviewing cases and approving site visits6 → 5 d

Estimated split of one analyst's working week, in hours, by hand and with the solution. Our estimate, not a measurement.

How it works

How a meter becomes a site visit

Six specialist agents read, balance, compare, explain and score every meter overnight; an analyst approves every visit.

What comes in
Data in5 sources · reads, events, balances, billing, past cases
Agents at work
Interval readerreads + events
Then
Energy balancer
Neighbour comparer
Explainer
Then
Signature matcherscore 0–100
Then
Visit plannerroute + safety
A person decides
Revenue protection analystapproves every visit
What comes out
Ranked suspects
Approved site visits
Monthly loss report
One case, step by step

One meter, from an overnight score to a crew on site

Lumina Utilities serves 1,238,400 smart meters across Aldermoor, Kestrel Vale, Corvin Heights, Saltmere and Harrowfield. On the night of Sunday 4 October, the cover of one meter on Calloway Row opens at 02:13. Here is what happens next, screen by screen, in the working solution.

  1. 0104:10–04:52

    Every meter read, every transformer balanced

    Interval reader and Energy balancer

    Overnight the interval reader takes 118.9M 15-minute reads and 41,207 events from 1,238,400 meters. The energy balancer balances 9,412 transformers for the last 30 days; 412 are above their expected loss. On feeder ALD-12, TX-4471 on Calloway Row delivered 18,600 kWh and billed 16,540 kWh — a gap of 11.1% against 3.2% expected, 1,465 kWh nobody can account for.

    “The gap says where; the suspects say who.”

  2. 02Morning

    The suspects chart: one dot far below the cluster

    Nadia Okafor · Revenue protection analyst

    Nadia covers Aldermoor and Kestrel Vale. Her home screen plots each of ALD-12's 214 meters by its own change in use against its neighbours' change on the same transformer, last 7 days against the prior 60. The cluster sits on the diagonal band: a cooler October, everyone using a little less. Four of them are suspects. 17 Calloway Row scores highest, at 94: red with an amber ring, a tamper event and a voltage signature together.

    17 Calloway Row · Suspect · Bypass suspected · 94/100

  3. 03Replay

    Replay the month and watch one meter break away

    Nadia Okafor · Revenue protection analyst

    The replay runs 29 days, 14 Sep to 12 Oct. The cluster drifts with the weather; on 5 October one dot breaks away from it. By Wed 7 Oct, 17 Calloway Row already scores 63 and is falling while its neighbours hold. By last night it is down 71% while its 21 neighbours fell 6%.

    “Replay · on Wed 7 Oct this meter scored 63”

  4. 04Ruled out

    The honest explanations come off first

    Explainer

    Before any score, the explainer checks billing for move-outs, the solar connections register, work orders, outage records and tariff changes. Last night it cleared 1,161 of the 1,912 meters that fell away from their neighbours. On ALD-12, 120 Brannock Road fell 79% but moved out on 2 Oct; 6 Hesketh Mews fell 61% after rooftop solar was connected on 30 Sep; two cover-open alarms were Lumina's own meter work, with no fall in use.

    Limit: the explainer never clears a meter with an open tamper event without an analyst, and writes the reason on every clearance.

  5. 05The case file

    94 out of 100, and every point names its source

    Signature matcher

    The case file lines up the meter events, the evening voltage, the energy a day and an hour-by-hour heatmap on one time axis, with the break on 5 Oct. The score under scoring v2.3: fall against neighbours 33 of 35, tamper and meter events 25 of 25, voltage signature 18 of 20, break in the load shape 14 of 15, likeness to confirmed cases 4 of 5. About 22.2 kWh a day is unbilled — 178 kWh since 5 Oct, $1,870 a year.

    “Evening voltage 4.8 V below the neighbours' median since 5 Oct, while the metered load is low”

  6. 06The night of 4 October

    The cover opens, and the load never comes back

    Signature matcher

    The night zoom shows 15-minute reads from Sunday 18:00 to Tuesday 06:00. At 02:13 the meter cover opens. At 02:14 power goes off at this meter only, for 5 min 12 s, while the 21 other meters on TX-4471 stay on — so it was not the network. Power is restored at 02:19 and the cover closes at 02:31. From then on the evening peak is gone and the voltage at the meter sits below its neighbours': current is being drawn through the service that the meter does not count.

    “02:14 Power off at this meter only (5 min 12 s)”

  7. 07How it was built

    Built step by step, and like bypasses already confirmed

    Six agents

    The case shows how it was built, agent by agent, with a time on each step, and finishes with the visit planner's draft waiting for Nadia. The likeness check compares it with 1,184 confirmed theft cases since 2019: 38 Kestrel Vale Road, a confirmed bypass in March with $3,120 back-billed; 5 Saltmere Drive, June, $2,460; and 212 more with the same pattern.

    “cover open + one-meter outage at night + evening sag”

  8. 08One click

    The visit, approved with its safety notes

    Nadia Okafor · Revenue protection analyst

    The visit planner has drafted work order WO-RP-2026-08841: crew RP-3, Dev Marsh and Kieran Holt, Wed 14 Oct 09:30–10:30, stop 1 of 6 on the Aldermoor route, unannounced under supply terms §14.3. It lists what to bring — replacement meter, seals ×4, clamp meter, camera, fuse pliers — and a note to the crew that 41 Calloway Row, on the same transformer, is on the route too. Nadia approves and schedules it.

    “Assume a live bypass. Two-person crew · class 0 insulated gloves · test before touch · isolate at the pole fuse on TX-4471 before the meter is removed.”

  9. 09The visits board

    Six stops, 42 km, and every result back to its case

    Dev Marsh · Field revenue inspector, crew RP-3

    The visits board shows what is still to approve, what is scheduled, which crew is on site now and which results are back. Dev's route for Wed 14 Oct starts at the Aldermoor depot at 08:45 with 17 Calloway Row. Monday's results are already in: a live jumper across the meter terminals at 22 Kestrel Vale Road, made safe and sealed with six photos; a magnet at 8 Pike Street; and at 31 Saltmere Drive no theft — a new heat pump, with a scoring note sent.

    “Nothing goes to a crew until an analyst approves it.”

  10. 10Month end

    One number for the board, and every dollar of it shown

    Graham Pell · Loss-reduction manager

    Graham's September loss report: $4.90M recovered since go-live in March, an annual rate of $8.4M; 61% of visits found theft, 251 of 412, against 13% before go-live; 37 live bypasses made safe in Q3, each the day it was found; non-technical loss at an estimated 1.1% of energy, against 1.4% in 2025. Recovery counts only back-bills paid or on a plan. He signs the month.

    “The run rate since March, $4.90M in seven months, gives the same $8.4M a year.”

Who it’s for

Built for everyone who protects the revenue.

The same meter on Calloway Row, seen by the four people who act on it — what their week looked like, and what it looks like now.

NO
Nadia OkaforRevenue protection analyst, Aldermoor and Kestrel Vale · approves visits and clearances
Revenue protection analyst
Before
Works the tamper-alarm list and approves 15–20 site visits a day, knowing most alarms are crews, batteries and comms faults. “A tamper alarm on its own is noise. A cover opening the night the load fell is a case.”
Now
Starts with the overnight suspects, sees the tamper event, the voltage signature and the break in the load shape on one timeline, and approves each visit with its safety notes.
DM
Dev MarshField revenue inspector, crew RP-3 · records results and photos
Field revenue inspector
Before
A two-person crew, 8–10 premises a day, most of them false leads. “Send me to the one where the meter's actually been got at, and tell me if it's live.”
Now
Gets a route drafted by the visit planner, the case file on the field app, and a live-bypass warning with the isolation steps before he touches the meter.
GP
Graham PellLoss-reduction manager · signs the month · approves scoring versions
Loss-reduction manager
Before
Owns the non-technical loss figure and the recovery target, and needs one number for the board with every dollar of it shown.
Now
Signs a monthly loss report that shows recovered dollars by month, the hit rate, bypasses made safe and how the estimate is made — and approves every change to how meters are scored.
RI
Ruth IbsenDistribution planner, Aldermoor network · reads balances and loading
Distribution planner
Before
Watches transformer loading and the upgrade plan. “Half my overloads are load nobody is paying for.”
Now
Sees each transformer's balance and the share its suspects explain, and is told when a transformer like TX-4471 peaks at 117% partly on unbilled load — before an upgrade is designed.
Built on the engine

6 agents. Each with one job, and hard limits.

Six specialist agents read, balance, compare, explain and score every meter overnight; an analyst approves every visit.

Interval reader

Reads 15-minute energy and voltage, the meter event log and comms status for every meter each night, and ties each read to its meter, transformer and account.

  • Never edits or estimates over a read — missing reads stay marked as missing
  • Read-only access to the head-end
Energy balancer

Balances each transformer and feeder for the last 30 days: delivered energy at the transformer meter against the sum billed to its meters, less the expected technical loss for its size and loading.

  • Never calls a gap theft without a meter-level signal
  • Flags a GIS mislink instead of a loss when a meter's voltage follows another transformer
Neighbour comparer

Computes each meter's change and its neighbours' change on the same transformer, weather-adjusted, last 7 days against the prior 60 — the suspects chart.

  • Never compares across transformers or tariffs without saying so
Signature matcher

Lines up tamper events, the voltage signature and the break in the load shape, scores each meter 0–100 with reasons, and compares it with 1,184 confirmed theft cases since 2019.

  • Never scores without listing every point and its source
  • Never changes the scoring version
Explainer

Rules out the honest causes before any score: move-outs and empty homes, new rooftop solar or batteries, meter exchanges and Lumina work, network outages, tariff changes and weather.

  • Never clears a meter with an open tamper event without an analyst
  • Writes the reason on every clearance
Visit planner

Drafts the inspection work order for each suspect: the crew covering the district, the stops in route order, a time window, safety notes for the suspected method and what to bring.

  • Never dispatches a crew — every visit waits for an analyst
  • Never contacts the customer or disconnects supply
Revenue protection analyst

Approves visits; inspector confirms; manager signs. The agents propose; a named person decides.

Ask in plain words

Ask about any meter, transformer or visit

Ask in plain words, or say what to change. Every answer points to the reads, events and balances behind it; visits and clearances always wait for an analyst.

Why is 17 Calloway Row at 94?

Three signals line up on one night, which is rare for an honest home. The meter cover opened at 02:13 on Mon 5 Oct, and power went off at this meter only for 5 min 12 s; the 21 other meters on TX-4471 stayed on. From that evening the voltage at the meter sits 4.8 V below its neighbours while the metered load is low. Use fell 71% (34.2 → 9.9 kWh a day) while its neighbours fell 6%. No move-out, solar, meter exchange or Lumina work explains it.

Which transformers on ALD-12 lose the most?

TX-4471, Calloway Row: 11.1% of its energy lost in the last 30 days against 3.2% expected, 1,465 kWh unexplained. Its two suspects explain 564 kWh of it (38%), and it peaked at 117% of its 50 kVA rating on Sat 10 Oct. Next is TX-4475, Fenwick Lane, at 5.6% against 3.1%, where 3 Fenwick Lane shows magnet events.

Show me the meters that were explained away

Four meters on ALD-12 were cleared last night: 120 Brannock Road fell 79%, but the move-out was recorded on 2 Oct and the load is a fridge; 6 Hesketh Mews fell 61% after rooftop solar was connected on 30 Sep; and two cover-open alarms were Lumina's own meter work, with no fall in use.

Plan tomorrow's visits in Aldermoor

Crew RP-3 (Dev Marsh, Kieran Holt) can take all four ALD-12 suspects on Wed 14 Oct, from the depot at 08:45: 09:30 17 Calloway Row, score 94, assume a live bypass; 10:15 41 Calloway Row, score 72, same transformer; 11:05 3 Fenwick Lane, score 74, magnet suspected; 11:50 9 Orrin Court, score 70. Nothing is sent until you approve.

Every screen

The working solution, as it ships.

13 screens from the working solution, on its sample data. Pick one to see it large.

The suspects chartEvery meter on feeder ALD-12 by its own change against its neighbours', coloured by tamper and voltage events, with the selected meter's score, signals and the ranked suspects.
Replay the monthTwenty-nine days in motion: the cluster drifts with the weather while 17 Calloway Row breaks away after 5 October.
Cleared, with the reasonMeters that fell for honest reasons — a move-out, new rooftop solar — shown hollow, each with what explained it.
The case fileMeter events, evening voltage, energy a day and an hour-by-hour heatmap on one time axis, beside the score with every point to its source.
The night it changed15-minute reads around 02:13 on 5 October: cover opened, power off at this meter only, and a load that never comes back.
How the case was builtEach agent's step with its time, the honest explanations checked and the confirmed cases this one looks like.
Approve the site visitThe drafted work order with crew, time window, right of access, what to bring and the live-bypass safety steps.
Site visitsVisits to approve, scheduled, on site and results back, and tomorrow's route for crew RP-3.
Energy balanceEach transformer's delivered energy against billed, the expected technical loss, the unexplained gap and how much its suspects explain.
Losses and recoveryRecovered by month, the share of visits that found theft, live bypasses made safe, how the estimate is made and loss by district.
Every meter on the feederAll 214 meters on ALD-12 with their change, their neighbours' change, events, status and score.
How a meter is scoredFive signals and their weights, the honest explanations checked last night and the suspect and watch thresholds.
Your rulesThe comparison window, the overnight run, who approves a visit, the live-bypass rule and the crews.
Governance

Built for the field: sourced, approved, made safe.

Every point of a score names its sourceEach signal in a score links to what it came from — the event log line, the 15-minute reads, the voltage against the neighbours' median, the transformer balance. The signature matcher never scores without listing every point and its source.
An analyst approves every visitAgents draft; nothing reaches a crew without a named analyst's approval. Home premises need one analyst and business premises two. The visit planner never dispatches, contacts a customer or disconnects supply.
Assume a live bypassEvery bypass or tap suspect is planned for a two-person crew with class 0 insulated gloves, test before touch and isolation at the pole fuse before the meter is removed, with the terminals photographed before anything is moved.
Cleared only with a reasonThe explainer writes the reason on every clearance, and a meter with an open tamper event can only be cleared by an analyst. Cleared meters stay on the chart, hollow, with what explained them.
Scoring versions, approved before they applyThe five signals and their weights are a versioned scoring method — v2.3, approved 3 Aug 2026 by Graham Pell. A change is previewed on the live feeder and applies only once approved, and every score keeps the version it was made with.
Every run and decision on the recordEach overnight run, approval, clearance, crew result and photo is recorded with who and when. No disconnection, back-bill or customer letter is produced here; confirmed cases pass to revenue protection case management.
Configuration

Your revenue protection rules, not ours

Thresholds, the comparison window, who approves and how crews work are settings. Every change is saved as a new settings version and applies from the next overnight run.

SettingDefaultChoose from
Suspect threshold70Raise or lower in steps — a suspect is shown on the chart with its address and a visit is drafted for approval
Watch threshold50Raise or lower in steps — a watched meter is re-scored nightly, with no visit
Comparison windowLast 7 daysLast 7 days · Last 14 days · Last 3 days, each against the prior 60 and the other meters on its transformer
Overnight run04:10 every night04:10 every night · 02:30 every night · 04:10 weeknights — after the head-end's daily reads land
Weather adjustmentOnOn · Off — compare only with meters on the same transformer and tariff
Who approves a visitOne analyst · two for businessOne analyst · two for business · Two analysts always · Loss-reduction manager
Assume a live bypassOnOn · Off — two-person crew, insulated gloves and isolation at the pole fuse on every bypass or tap suspect
Crews4 crews · 10 stops4 crews · 10 stops · 4 crews · 8 stops · 5 crews · 10 stops
Connections

Works with the meter-to-cash data you already have

AMI head-end15-minute energy and voltage, meter events and comms status
Transformer metersdelivered energy at every distribution transformer, for the energy balance
GIS connectivitywhich transformer and phase each meter hangs off
Billingaccounts, tariffs, move-ins and move-outs
Work orders and the solar connections registermeter exchanges, field work, rooftop solar and batteries
Confirmed theft cases1,184 since 2019, with photos and back-bills
What it changes

The difference, in numbers.

Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.

estimated
$8.4M
a year recovered: 1% of $2.1B revenue exposed to tampering, 40% recovered
Exposed$21M a year
Recovered$8.4M
target
Every
live bypass found is a fire and shock hazard made safe the same day
37 of 37
made safe the day found, Q3
target
3 in 5
site visits find theft, against 1 in 8 from tamper alarm lists
Alarm lists13%
Scored suspects61%

“demo” = seen in the working solution, on its sample utility data · “estimated” = our arithmetic, inputs shown ($8.4M = $2.1B electricity revenue × about 1% exposed to tampering × 40% recovered; the analyst-week split is our estimate) · “typical” = published figures (Northeast Group via EEPower: $89.3B lost to electricity theft a year worldwide; US DOE smart grid programme results: meter tampering about 1% of revenue; S&C Electric via Ventavid: $250–$500 a field visit). Lumina Utilities and the people, streets, feeders, crews, cases and records named on this page are fictional — characters and sample data in the working solution.

Questions

What revenue protection teams ask us.

What is energy theft detection software?

Software that finds which meters are most likely being tampered with or bypassed, so revenue protection crews go where theft is. Energy Theft Detection scores every smart meter overnight from its AMI interval data, events and voltage, rules out the honest explanations and gives the analyst a case file with every point of the score traced to its source.

How does electricity theft detection with AMI data work?

Six agents read every meter's 15-minute energy, voltage and events, balance every transformer against what its meters were billed, and compare each meter with its neighbours on the same transformer. A meter that falls far more than its neighbours, with a tamper event, an evening voltage sag and a break in its load shape on the same night, scores high; the explainer first removes move-outs, new solar, meter exchanges, crew work and outages.

How is it different from working tamper-alarm lists?

A tamper alarm on its own is mostly noise — the utility's own crews, battery and comms faults. Here tamper and meter events are worth at most 25 of the 100 points; the rest comes from the fall against the neighbours, the voltage signature, the break in the load shape and likeness to confirmed cases. In the demo, 7 Ashby Close has a cover-open alarm but its use moves with its neighbours, so it scores 23, and 61% of September's visits found theft, against 1 in 8 from alarm lists before go-live.

Does it keep field crews safe on a suspected bypass?

Every bypass or tap suspect is planned as a live bypass: a two-person crew, class 0 insulated gloves, test before touch and isolation at the pole fuse before the meter is removed. The rule is a setting, on by default, and the safety steps are on the work order the analyst approves.

Can it find theft that doesn't trigger a tamper event?

Yes, when the other signals show it. In the demo, 41 Calloway Row scored 72 with no tamper event: a 3.9 V evening sag and a flat load since 22 Sep pointed to a tap before the meter. The case file says plainly that the cover was never opened.

Do people stay in control?

Yes. The agents read, score and draft; an analyst approves every visit, two analysts for a business premise, and only an analyst can clear a meter with an open tamper event. The visit planner never dispatches, contacts the customer or disconnects supply, and the loss-reduction manager approves every scoring change and signs the month.

Does it also work for water theft?

Water is the next phase. The settings already list reverse-flow and magnet events on Lumina's 412,000 water meters, switched off for now.

How long does it take to go live?

The Agentic Solution Engine builds and deploys it from your requirements and documents — your AMI and event data, transformer metering, GIS connectivity, billing and past confirmed cases — and it goes live once every quality gate has passed. We will walk you through it on your own meters first.

See it on
your meters.

We'll run Energy Theft Detection on a sample of your own AMI reads and confirmed theft cases.