Enhancing Revenue Protection Through Proactive Monitoring

This was the first meeting of the Revenue Protection Group, created to explore how utilities are managing the surge of tamper flags—also known as meter events—that come from AMI systems. As expected, most participants are seeing huge volumes of these alerts and are working to figure out which ones really matter. One common theme: a single tamper flag rarely triggers a field visit on its own. Instead, most companies are combining these alerts with other data points—usage, outages,

customer history—to build a clearer picture before acting.

Participants ranged from early-stage AMI implementers to those with more mature processes. A number of companies are using internal teams or vendor platforms like Itron to organize and prioritize meter events. Some are building dashboards, others are scripting with Python, and a few are beginning to experiment with AI and machine learning to identify patterns of theft. Nearly everyone emphasized the importance of doing as much as possible from the office before rolling a truck.

Key Takeaways

• Alert Volume is Overwhelming: After AMI deployment, most companies receive far more alerts than they can manage—some seeing millions. Many have turned off low-value alarms and focus on a short list of high-confidence events.

• Prioritization Before Field Action: Teams are combining data sources—like load profiles, weather, outage logs, and historical usage—to assess whether a meter event is worth investigating. This office-based triage has become the standard.

• Analytics in Action: Companies are using a mix of custom tools and vendor platforms to filter and score meter events. Python scripts, Itron dashboards, and SQL-based views are commonly used to prioritize cases.

• AI and Machine Learning (ML) are Emerging: A few organizations are testing ML models—training them with past theft cases and creating risk scores. Others are exploring AI integrations via Google Cloud or vendor platforms, though most are still in exploratory phases.

• False Positives are Common: Many events are caused by outages or installation issues rather than theft. For example, reverse rotation often turns out to be a meter installed upside down—not malicious activity. Field verification is still critical in many cases.

• Terminology Varies: Some refer to these as “tamper flags,” others as “meter events,” but all are referring to alerts coming from AMI systems. It’s important to define the terms clearly across teams.