A computer-implemented method for detecting electricity fraud, the method comprising: accessing a known dataset, the known dataset including first data items associated with known cases of electrical fraud; determining a set of suspicious known cases by at least applying a detector behavior of a model to the first data items; determining, from the set of suspicious known cases, a set of explained known cases by analyzing each of the known cases in the set of suspicious known cases against one or more false positive explanations of the model, wherein the set of explained known cases is a subset of the set of suspicious known cases; validating the model based on the determined set of suspicious known cases; access an unknown dataset, the unknown dataset including second data items associated with unknown cases of electrical fraud at a plurality of service points, wherein each service point of the plurality of service points corresponds to an electricity meter, and wherein the second data items include electricity demand associated with the electricity meter corresponding to each service point; determining a set of suspicious unknown cases by at least applying the detector behavior to the second data items; determining, from the set of suspicious unknown cases, a set of explained unknown cases by analyzing each of the unknown cases in the set of suspicious unknown cases against the one or more false positive explanations, wherein the set of explained unknown cases is a subset of the set of suspicious unknown cases; and determining a set of unexplained unknown cases by subtracting the set of explained unknown cases from the set of suspicious unknown cases, wherein the set of unexplained unknown cases is a subset of the set of suspicious unknown cases that does not overlap with the set of explained unknown cases. accessing a known dataset, the known dataset including first data items associated with known cases of electrical fraud; determining a set of suspicious known cases by at least applying a detector behavior of a model to the first data items; determining, from the set of suspicious known cases, a set of explained known cases by analyzing each of the known cases in the set of suspicious known cases against one or more false positive explanations of the model, wherein the set of explained known cases is a subset of the set of suspicious known cases; validating the model based on the determined set of suspicious known cases; access an unknown dataset, the unknown dataset including second data items associated with unknown cases of electrical fraud at a plurality of service points, wherein each service point of the plurality of service points corresponds to an electricity meter, and wherein the second data items include electricity demand associated with the electricity meter corresponding to each service point; determining a set of suspicious unknown cases by at least applying the detector behavior to the second data items; determining, from the set of suspicious unknown cases, a set of explained unknown cases by analyzing each of the unknown cases in the set of suspicious unknown cases against the one or more false positive explanations, wherein the set of explained unknown cases is a subset of the set of suspicious unknown cases; and determining a set of unexplained unknown cases by subtracting the set of explained unknown cases from the set of suspicious unknown cases, wherein the set of unexplained unknown cases is a subset of the set of suspicious unknown cases that does not overlap with the set of explained unknown cases. access an unknown dataset, the unknown dataset including second data items associated with unknown cases of electrical fraud at a plurality of service points, wherein each service point of the plurality of service points corresponds to an electricity meter, and wherein the second data items include electricity demand associated with the electricity meter corresponding to each service point; determining a set of suspicious unknown cases by at least applying the detector behavior to the second data items; determining, from the set of suspicious unknown cases, a set of explained unknown cases by analyzing each of the unknown cases in the set of suspicious unknown cases against the one or more false positive explanations, wherein the set of explained unknown cases is a subset of the set of suspicious unknown cases; and determining a set of unexplained unknown cases by subtracting the set of explained unknown cases from the set of suspicious unknown cases, wherein the set of unexplained unknown cases is a subset of the set of suspicious unknown cases that does not overlap with the set of explained unknown cases.