# Advanced Methodology for Fraud Detection in Energy Using Machine Learning Algorithms
## 4 The Proposed System's Goals, Approach, and Architecture
A EUR 25 threshold was highlighted as a significant marker for fraud, with billing amounts below this threshold potentially signaling suspicious activity. As depicted in the graph, a notable concentration of billing amounts under EUR 25 may indicate intentional under-reporting or tampering, but additional analysis is performed to exclude cases linked to vacant or low-usage properties. \begin{table}
\begin{tabular}{c c} \hline \hline
**Client ID** & **Anonymized Client Code: SQ ******* \\ \hline \hline \multicolumn{2}{c}{Counterfeiting/removal of metrological seal;} \\ \multicolumn{2}{c}{Theft Type} & Meter reading anomalies; \\ \multicolumn{2}{c}{Meter reading anomalies.} \\ \hline \hline Consumption Anomalies & YES \\ \hline \hline Biling Amount & \textless{}25 EUR \\ \hline \hline Smart and Non-Smart Grid & YES \\ \hline \hline Verified & NO \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Consumer fraud characteristics. Box Plot of Consumption Anomalies: A box plot comparing consumption anomalies between fraudulent and non-fraudulent consumers reveals that fraudulent consumers underscore the potential for building a scoring model based on anomaly detection, where the number of anomalies can serve as a key indicator for identifying fraud. Fraudulent consumers tend to show more extreme consumption behaviors, supporting the need for a robust detection system. Figure 2 presents the distribution of billing amounts, highlighting the concentration of values below a specific threshold (<25 EUR), which may indicate intentional underreporting or manipulation of consumption. This analysis helps identify potential anomalies and supports the development of fraud detection models by recognizing unusual billing patterns. Figure 3 illustrates the time series plot of billing amounts, highlighting the billing patterns over time for both fraudulent and non-fraudulent consumers. As observed, fraudulent consumers exhibit inconsistencies and irregularities in their billing amounts, with noticeable spikes and drops that deviate from expected seasonal trends. This time series analysis allows for the identification of irregular billing patterns, which can serve as a further indicator of potential fraudulent behavior, particularly when compared against normal consumption trends in the region. The visualization in Figure 4 complements the data presented in Figure 2 and reinforces the importance of monitoring billing thresholds and consumption anomalies to effectively detect energy theft. Integrating these findings enables a comprehensive fraud detection approach, combining statistical analysis, machine learning, anomaly detection. In addition to the 1872 consumers who were found to be fraudulent, we also chose 1872 customers from Iasi County who were classified as non-fraudulent users. Data regarding their energy use, spanning from 2018 to 2023, are analyzed for comparative purposes. The selection of this five-year period is significant, as it allows us to observe variations in consumption caused by seasonal fluctuations, economic factors, and climatic conditions. Figure 2: Distribution of billing amounts. This extensive dataset, integrating both fraudulent and non-fraudulent consumption patterns, includes a range of critical indicators, such as financial metrics, usage profiles, the date of the last inspection, the year the meter was installed, overdue payments, inactivity periods, billing intervals, and GIS-based location. These variables form the foundation for building a comprehensive fraud detection model that can accurately assess the likelihood of energy theft in a variety of contexts. In addition to adhering to specific technological standards, the collected data underwent an anonymization process that eliminated certain consumer identifying information, such as the client's name, phone number, contract number, etc. The following steps were part of the overall process, which was based on functional networks: variable selection, data filtering, model selection, model analysis, and model evaluation.