Why Utility Companies Are Easy Targets for Identity Fraud, and How to Close the Gap
Key takeaways
- Utility accounts are often targeted for identity fraud because legacy onboarding relies on static data checks, and billing cycles combined with notice-and-cure regulations delay detection for months.
- Synthetic identity fraud, AI-personalized scam outreach, and deepfake attacks on verification systems are escalating the threat landscape.
- Weak verification exposes utilities to chargebacks, regulatory risk, and unrecoverable revenue, while fraudsters use utility bills as gateway "proof of residence" documents to breach banks and financial platforms.
- The fix is real-time verification at signup, checking a government-issued ID against a live selfie or liveness check without creating friction that violates state accessibility rules.
- Lightico's identity verification (IDV) capability, part of its broader journey orchestration platform, closes this gap by verifying customers in real time inside the utility's own website, app, or contact center flow.
Opening a utility account is often easier than opening a bank account, and fraudsters know it.
While banks enforce strict "Know Your Customer" (KYC) onboarding, utility sign-ups often require little more than a name, address, and Social Security number. Combine these minimal checks with 30- to 60-day billing cycles, and criminals gain a wide window of free service before any red flags trigger.
For utilities operating across multiple state-regulated territories, this exposure compounds quickly. Every unverified account movement creates another point of failure, costing providers millions in unrecoverable revenue, chargebacks, and regulatory risk.
Stopping this fraud doesn't require regulatory overhauls or sluggish onboarding. It simply requires verifying identity at the exact moment an account is opened. Here is why utilities have become prime targets for identity fraud, and how digital-first verification closes the gap.
Why utilities are attractive fraud targets
Three structural gaps make utility accounts an easier mark than most other regulated services.
Weak identity checks at onboarding
Compared to banks, many utilities struggle with legacy onboarding checks that fail to stop modern fraudsters. While utilities are federally required to prevent identity theft under the FTC’s Red Flags Rule, traditional compliance relies on passive database lookups like checking a name against a Social Security number. Fraudsters easily bypass these static checks using stolen or synthetic identities and because utilities lack bank-grade "Know Your Customer" (KYC) verification at signup, bad actors open accounts undetected.
Slow detection and Disconnection Realities
Standard billing cycles stretch 30 to 60 days, giving bad actors weeks of free electricity, gas, or water before red flags trigger. Compounding the issue, state-mandated notice-and-cure regulations require utilities to issue formal warnings before shutting off service for non-payment. When combined with seasonal shutoff moratoriums, a single unverified account can result in months of unpaid service and unrecoverable revenue before the account can legally be closed.
Gateway to Higher-Tier Financial Fraud
Utility accounts are prime targets not only for stolen service, but because an official utility bill is the gold standard for "proof of residence" across the web. Criminals open fraudulent utility accounts specifically to obtain a billing statement, which they then use to pass identity checks at banks, crypto exchanges, and government assistance programs. Stopping utility fraud at registration prevents bad actors from creating the documentation needed to fuel broader financial crimes.
AI is escalating fraud on multiple fronts
Three developments are raising the stakes for utilities specifically.
Synthetic Identity Fraud
Synthetic identity fraud blends real personal data, such as a valid Social Security number, with fabricated names and details. It is difficult to catch precisely because it does not map to a single real victim who can report it. That absence of a clear victim makes it especially persistent across regulated industries.
Targeted Scam Outreach
AI is making customer-facing scams sharper and cheaper to run. Fraudsters use AI to analyze a potential victim's online presence and personalize scam outreach, as well as generate geographically targeted ads that appear when people search for terms related to their energy bills. AARP's Director of Fraud Prevention Programs, Kathy Stokes, has described this shift as giving scam operations an industrial-scale leap in capability.
Deepfakes vs. Verification Systems
AI is being turned against verification systems as well, not only against customers. The Financial Action Task Force's December 2025 Horizon Scan on AI and deepfakes found that fraud detection has not kept pace with generative AI, and that deepfake images, video, and audio can pass through liveness and biometric checks undetected until later in the review process. For a utility, that means the same ID-and-selfie check built to stop fraud can itself become a target, which is why the quality of the liveness detection behind a verification flow matters as much as having one at all.
As customer-facing scams increase, legitimate utility verification requests are increasingly mistaken for phishing, which can leave real customers hesitant to complete a signups.
What weak verification actually costs utilities
The cost isn't only the value of stolen service. It shows up in a few places at once:
- Chargebacks and unrecoverable losses on accounts that never should have opened in the first place.
- Regulatory and compliance exposure, particularly where state commissions require documented verification steps for deposits, payment agreements, or assistance enrollment, and particularly for utilities managing different rules across multiple service territories.
- Erosion of customer trust when a utility's own legitimate verification request gets mistaken for the scam it's trying to prevent.
What closing the gap looks like
Closing the gap comes down to verifying identity once, correctly, at the moment an account opens, in place of detection that happens weeks later after the damage is done.
That means checking a government-issued ID against a live selfie or liveness check at signup, in place of relying on static data points like a name and a billing address.
Because Public Utility Commissions hold utility providers to strict accessibility standards, any verification system must balance security with ease of use. Lightico's identity verification flow operates directly inside the utility's own website, mobile app, or contact center workflow. Customers upload an ID and complete a guided liveness check in the channel they already trust. Contact center agents can initiate the exact same mobile flow during phone signups, ensuring that vulnerable, unbanked, or less tech-savvy populations receive guided support while maintaining full regulatory compliance.
IDV sits inside Lightico's broader journey orchestration platform, which also handles e-signatures, document collection, and workflow automation. Utilities can apply AI-powered intelligent document processing (IDP) to supporting paperwork like proof of income or assistance program applications, validating supporting documents automatically instead of reviewing them line by line in an email inbox.
A familiar before-and-after
Consider a large electric utility that, until recently, asked new customers to email a photo of their driver's license and a selfie before service could be activated. Those images sat in a shared inbox until an agent had time to review them by eye, with no automated check that the face matched the ID or that the ID itself was genuine, and no reliable way to know how many fraudulent applications slipped through while the request waited. Moving that same check into a real-time, guided flow at the moment of signup turns a slow, unvalidated manual step into an automated one that happens before the account is ever created.
Utilities including Southern Company and PECO already use Lightico's identity verification product for this kind of onboarding check.
Done this way, verification replaces manual document review and emailed attachments with a guided flow that takes minutes, delivering a stronger identity check and a faster signup together.
See Real-Time Identity Verification in Action
Learn how leading utility providers stop onboarding fraud without adding friction for legitimate customers: Explore Lightico Identity Verification.
Ready to see how it works on your customer journey? Request a Demo.
Frequently asked questions
Why are utilities targeted by identity fraud?
Utility signups often verify identity with static details such as a name, address, and Social Security number, which stolen and synthetic identities pass easily. Monthly billing and state disconnection rules then delay detection for weeks or months. Fraudsters also value the utility bill itself, because state DMVs and many financial providers accept one as proof of residence.
What is synthetic identity fraud?
Synthetic identity fraud combines real personal data, often a valid Social Security number, with invented names and details to create a person who doesn't exist. Because no single real victim notices and reports it, the fraud can look like ordinary bad debt. The Federal Reserve has published an industry definition to help organizations tell synthetic identity fraud apart from other losses.
Does the FTC Red Flags Rule apply to utilities?
Coverage depends on a utility's activities. The FTC's Red Flags Rule covers creditors that regularly use consumer reports, report to credit bureaus, or lend money. Many utilities pull credit reports for deposits or report payment data, which brings them under the rule. A covered utility needs a written identity theft prevention program that its board or senior management approves.
Why do fraudsters want a utility bill?
A utility bill in a fraudster's name works as proof of residence. State DMVs, including California's, list a home utility bill as an acceptable residency document for a REAL ID, and many financial providers accept one to confirm an address. A fake utility account gives a stolen or synthetic identity the paperwork it needs to pass checks at banks, lenders, and government programs.
How can utilities verify identity without adding friction?
Friction usually comes from emailed documents, third-party redirects, and manual review queues. A real-time check inside the utility's own website or app avoids all three: the customer photographs a government-issued ID and completes a guided selfie with liveness detection on their phone. Contact center agents can send the same guided step by text during a phone signup, so customers who need help still get it.
Can deepfakes beat selfie and liveness checks?
Deepfakes can defeat weak biometric checks. FATF's horizon scan on AI and deepfakes warns that criminals use AI-generated images, video, and audio to manipulate biometric authentication and get around digital identity verification. It points to advanced liveness detection, combining passive and active methods, as part of the response. For utilities, the quality of the liveness check matters as much as having one.
Does identity verification work for contact center signups?
Phone signups carry the same fraud risk as online ones, and agents can't inspect an ID over a call. A guided flow solves both: the agent texts the customer a secure link, the customer photographs their ID and completes a liveness check on their phone, and the result returns to the agent before service begins. Customers who are less comfortable online get help from a live agent throughout.
Glossary
| Term | Definition |
|---|---|
| Identity verification (IDV) | Confirming that the person opening an account is who they claim to be, usually by checking a government-issued ID against a live selfie. |
| Know your customer (KYC) | The identity checks banks and other financial institutions run before they open an account or provide a service. |
| Customer Identification Program (CIP) | The US rule that requires banks to collect and verify a customer's name, date of birth, address, and ID number when an account opens. |
| Red Flags Rule | An FTC rule that requires covered financial institutions and creditors, including many utilities, to keep a written program for spotting and responding to signs of identity theft. |
| Synthetic identity fraud | Fraud that pairs real data, such as a valid Social Security number, with invented details to create a person who doesn't exist. |
| Liveness check | A test that confirms a selfie or video came from a live person in real time, which blocks printed photos and replayed recordings. |
| Deepfake | An AI-generated or AI-altered image, video, or audio clip that imitates a real person. |
| Disconnection protections | State rules that require notice before a utility shuts off service. Most states also limit shutoffs during extreme cold or heat. |
| Proof of residence | A document, such as a utility bill or lease, that shows a person's name at an address. DMVs and financial providers use it to confirm where someone lives. |
| Chargeback | A card payment reversal that the cardholder's bank initiates, often after the real cardholder disputes a fraudulent charge. |
About Lightico
Lightico is a journey orchestration platform that helps regulated industries, including utilities, banking, auto finance, insurance, and telecommunications, complete complex customer interactions in a single digital session. Its capabilities include identity verification, e-signatures, document collection, and workflow automation, letting businesses move a customer from first contact to a completed, compliant transaction without switching tools or channels. Utilities including Southern Company, PECO, and BT rely on Lightico to modernize onboarding, billing, and compliance workflows across self-service and contact center channels. Learn more at www.lightico.com.
