Non-technical loss is one of the few line items a utility can attack with data it already owns. The reads are there. The theft is in them. What’s missing is a way to point a small inspection team at the right meters — because knocking on doors at random is slower and more expensive than the loss itself.

We took a large, public smart-meter panel — the SGCC dataset, 42,372 customers with more than a thousand daily reads apiece and a realistic theft rate near 8.5% — and ran it through the full detection pipeline exactly as a utility would run its own AMI.

From reads to features

Raw interval reads are noisy: dropouts, spikes, missing days. The pipeline cleans and imputes them, then encodes each customer as 43 behavioural statistics and a 148-point weekly profile — the rhythm of an account, not just its total. Under-reporting, zero-padding and flatline tampering each leave a different fingerprint in those features, and the model is trained to tell them apart.

Scoring and the gate

An imbalance-weighted LightGBM classifier scored every customer. Because theft is rare, the model was measured on PR-AUC and recall rather than headline accuracy, and it had to pass a release gate — beating both a logistic-regression and a prevalence baseline — before its scores counted. On this panel it reached a ROC-AUC around 0.82, with the operating point set to recall the majority of true theft cases at the best precision available.

The deliverable was never a label on a customer. It was an ordering of the whole book — who to visit first.

The audit queue

The output was a ranked audit queue: every customer ordered by theft probability, highest first, so a team that can only inspect a few hundred premises a month spends that capacity where it recovers the most. Each flagged account carried the behavioural signals that raised it, so an inspector arrived informed — and the score stayed a lead, with a person making the final call at the meter.

The theft was always in the data. What changed was the order of the list: instead of a full book and a random walk, the utility got a short, explainable, capacity-aware queue — and a repeatable way to regenerate it every billing cycle.

Key takeaways

  • A 42,372-customer meter panel was scored end to end, from raw reads to queue.
  • Cleaning and behavioural encoding turned noisy reads into learnable fingerprints.
  • An imbalance-tuned model, gated on recall and baselines, produced trustworthy scores.
  • The result was a ranked, explainable audit queue matched to real inspection capacity.