How should energy providers implement digital onboarding to reduce fake service subscriptions and other scams?

Energy providers should combine identity verification, liveness checks, IP and geo intelligence, risk scoring, phone and email assessment, and device fingerprinting. The goal is to verify that the applicant is a real person or legitimate company, then flag inconsistencies before account creation. In regulated utilities, that layered approach reduces fraud without forcing excessive friction on genuine customers.

Why This Matters for Security Teams

digital onboarding in energy and utility services is a fraud-control gate, not just a customer experience step. Fake subscriptions are often used to open accounts with stolen or synthetic identities, divert billing, or gain a foothold for payment scams and service abuse. Because utilities operate at scale and must balance access with regulation, weak onboarding becomes a downstream problem for billing, collections, and operational security. Guidance from eIDAS 2.0 — EU Digital Identity Framework reinforces the direction of travel toward stronger, reusable digital identity assurance.

NHI Management Group’s research shows the breadth of identity risk in real environments: only 5.7% of organisations have full visibility into their service account, and 79% have experienced secrets leaks, with 77% of those incidents causing tangible damage. That matters here because onboarding controls only work when the identity layer is trustworthy from the start, and fraud teams can correlate signals across application, device, and network context. In practice, many security teams discover subscription fraud only after billing disputes, field-service dispatches, or account takeover have already created cost and exposure.

How It Works in Practice

Effective onboarding combines proof-of-personhood signals with fraud analytics and policy decisions made at application time. The goal is not to block every risky applicant, but to grade trust before an account is created and to step up verification when the risk profile is inconsistent. For regulated utilities, that usually means layering document checks, liveness detection, phone and email reputation, device fingerprinting, and IP or geo-location intelligence into one decision flow.

Security teams should treat this as a data correlation problem. A stolen identity may pass one check, but it often fails several at once. For example, a valid government ID paired with a disposable email, mismatched geolocation, and a high-risk device can justify friction or manual review. The same applies to business onboarding, where entity validation, beneficial owner checks, and sanctions screening should align with the expectations described in the FATF Recommendations — AML and KYC Framework.

• Use identity proofing to establish that the applicant exists and matches the claimed identity.
• Apply liveness and session integrity checks to reduce spoofing and replay attempts.
• Score phone, email, IP, and device signals together instead of treating them separately.
• Trigger step-up verification for mismatches, not for every application.
• Log onboarding decisions so fraud analysts can tune thresholds and investigate patterns.

For implementation design, it helps to compare this with what happens when credentials and tokens are reused across systems. NHIMG case studies such as the JetBrains GitHub plugin token exposure and the Schneider Electric credentials breach show how trust in a single identifier or token can fail when surrounding signals are ignored. These controls tend to break down when onboarding is optimized purely for speed and exceptions are handled manually, because fraudsters adapt faster than static rule sets can be updated.

Common Variations and Edge Cases

Tighter onboarding often increases abandonment and support cost, requiring organisations to balance fraud reduction against customer conversion and regulatory expectations. That tradeoff is especially sharp for energy providers serving vulnerable customers, renters, shared households, and business customers with limited digital footprints. Current guidance suggests using differentiated policies rather than one universal flow.

There is no universal standard for this yet, but best practice is evolving toward risk-based orchestration. Low-risk applicants may clear with lightweight checks, while higher-risk cases move to document review or assisted verification. Special cases include proxy IP use, mobile network address churn, and customers applying on behalf of a company or property manager, all of which can look suspicious unless context is captured. When identity is thin, the decision should rely on multiple weak signals rather than a single absolute match.

Fraud controls also need clear exception handling. False positives are common when customers travel, use accessibility tools, or share devices in a household. If the onboarding stack cannot explain why an application was challenged, support teams will override it and fraud pressure will return. The practical aim is a policy that is strict enough to stop fake service subscriptions, but transparent enough to preserve legitimate access.

Related resources from NHI Mgmt Group

• How should organisations reduce identity theft risk in digital onboarding?
• How should organisations implement real-time business verification in digital onboarding workflows?
• How should import and export teams implement digital signature certificates in DGFT workflows to reduce manual delays?
• How should governments implement PKI in digital services to strengthen trust and reduce fraud risk?