Utility impostor scams now run as AI-powered, multi-channel campaigns. Here’s how they work, where awareness falls short, and how utilities can disrupt the infrastructure behind them.
Every November, utilities across the U.S. and Canada spend a day telling customers the same thing: if someone calls threatening to shut off your power unless you pay right now, hang up and verify the request directly with your utility provider.
This year, Utility Scam Awareness Day is Wednesday, November 18. It’s led by Utilities United Against Scams (UUAS) (opens in new tab), a coalition of more than 150 electric, water, and gas utilities companies, and it’s been on the calendar since the 2016 House resolution (opens in new tab).
It’s good advice. But the scams customers are being warned about aren’t just random phone calls anymore. They’re campaigns that include cloned websites, scam ads, mass texts, spoofed calls, and now, AI-generated voices. Teaching customers to pause matters, but it only helps at the very end of an attack that started weeks earlier.
In this post, we’ll look at how AI is changing utility impostor scams and why awareness alone can’t stop them. We’ll also cover how utilities can go after the infrastructure behind these scams, with a quick checklist to use before November 18.
The formula is simple: manufactured urgency, a threat of shutoff, and a demand for immediate payment.
The UUAS guide describes scammers who spoof caller ID, set up call-back numbers with replicated utility greetings, and push for prepaid cards or wire transfers. Real utilities, by contrast, mail disconnection notices before shutting off service and don't dictate a payment method.
The same playbook has many variations: fake overpayment refunds, bogus equipment fees, "power restoration" charges after storms, spoofed bills, fake job listings, and impostor workers at the door.
The losses add up. The 2024 BBB Scam Tracker Risk Report (opens in new tab) put the median reported loss to a utility scam at $435 and found that activity tends to spike during storms, heat waves, and billing cycles. Duke Energy reported (opens in new tab) more than 5,600 scam reports across its service areas through the end of October 2025. PG&E said (opens in new tab) it received nearly 700 reports in 2025, with customers losing nearly $300,000.
The old tells, like awkward phrasing and robotic scripts, are disappearing.
Utilities are reporting the shift themselves:
Industrialized tooling makes this easy to scale. Modern phishing kits (like Darcula V3) let operators clone a real brand's website, add payment forms, and distribute lures by text, with no coding required.
The wider market agrees: Gartner found (opens in new tab) that 62% of organizations experienced a deepfake attack involving social engineering or exploiting automated processes in its 2025 survey.
Before a customer's phone rings, the attacker has already done the groundwork. They have:
That's the front end of the social engineering attack chain, and most defenses only see it once a customer calls to report the damage.
UUAS has warned about (opens in new tab) exactly these channels, including fake utility ads and search-engine scams. The trouble with going after scams one at a time is that operators just rebuild. Taking down a single phishing page doesn’t touch their other domains or phone numbers, or their ability to put the same scam back up somewhere else, so watching for it to reappear matters as much as the first removal.
That’s also where older approaches to digital risk protection tend to fall short: they chase individual alerts instead of shutting down the whole campaign.
UUAS's Slow Down, Verify, Stop the Scam (opens in new tab) framework gives customers three clear steps: pause when a payment request creates panic, confirm through the official number on the bill, and report it. UUAS also works with members to get scammers' toll-free numbers taken out of operation, according to the same release.
Awareness has limits, though. It depends on a person under pressure making the right call; it only reaches customers who see the message, and it leaves the scam infrastructure running for the next victim. The strongest programs pair education with disruption.
We see this with customers outside utilities, too. ARK Invest cut scam takedown times from weeks to minutes and reduced impersonation volume by 50% year over year. ARK isn't a utility, but the dynamic is the same: when customer-reported scams feed directly into investigation and takedown, each report shuts down the campaign instead of just logging it.
Scammers don’t stick to the channels you own. Watch for lookalike domains, fake social profiles, scam ads, cloned apps, and spoofed phone numbers, and treat brand impersonation as an ongoing exposure rather than a one-time cleanup.
A fake ad, a cloned site, and a scam number usually belong to the same operation. Linking them in one shared view shows you the whole campaign instead of a pile of unrelated alerts.
Speed is what limits the damage. Doppel customers have seen takedown times drop by 97%, and phishing infrastructure is typically mitigated in under an hour at the median. Track how long it takes to shut a scam down and how often attackers reuse the same assets, rather than how many alerts you’ve cleared. This workflow shows which numbers are worth watching.
Every call, email, or form a customer sends about a suspicious message is a signal. Route those reports into investigation and removal instead of letting them sit in a queue, and do the same with the suspicious emails employees flag.
When a phish does land, quarantining the message isn’t enough. The goal is to trace it back to the infrastructure behind it, so the same campaign can’t simply try the next mailbox.
Executives are prime targets for fake profiles, deepfakes, and leaked personal details. Monitoring for impersonation early keeps a spoofed voice or profile from reaching customers or staff.
Contact center agents and helpdesk staff get targeted too, and the pressure tactics that work on customers work on them as well.
Realistic voice, text, and email simulations show where verification breaks down, and ongoing training helps close those gaps. The helpdesk is a common weak point, as a recent vishing attempt linked to ShinyHunters showed.
Hiring is another soft spot, since fake job listings and AI-driven interview scams are on the rise. The same pressures apply across energy and utilities more broadly.
Utility Scam Awareness Day is a chance to reach customers. Pair that outreach with a plan to find and dismantle the infrastructure behind the scams, and every report becomes a way to protect the next customer.
Sign up here before November 18 for a free custom assessment of threats targeting your utility organization.
