Embodiments of the disclosure are directed towards electricity fraud detection systems that involve a behavioral detection ecosystem to improve the detection rate of electricity fraud while reducing the rate of false-positives. More specifically, machine learning algorithms are eschewed in favor of two separate models that are applied sequentially. The first model is directed to improving the detection rate of electricity fraud through the use of detectors to identify customers engaging in suspicious behavior based on the demand profiles of those customers. The second model is directed to reducing the rate of false-positives by identifying potential legitimate explanations for any suspicious behavior. Subtracting away the suspicious behavior with legitimate explanations leaves only the identified, unexplained suspicious behavior that is highly likely to be associated with fraudulent activity.