Data driven approaches have been widely employed in recent years to detect electricity thefts. Although many techniques have been proposed in the literature, they mainly focus on electricity thefts by consumers of power from the grid. Existing studies do not consider electricity thefts by prosumers, who act as both supplier and consumer in the energy system. This is of great importance as inaccurate reports of prosumers’ behaviours can disturb power system operation. Here, the paper examines the role prosumers may play in subverting the energy system and propose a novel means of detecting such malfeasance. Specifically, this work introduces a new electricity theft attack scenarios called balance attacks, where an attacker concurrently modifies his readings along with neighbouring meters in an attempt to balance the total aggregated reading. Such attacks can be difficult to detect by existing solutions that reach detection decisions based on aggregated readings. A novel electricity theft detector is proposed that can detect thefts in the presence of prosumers. Current approaches use either a single model for all users across the system or else a model for each user. Here, a half-way house approach is adopted where a cluster-based detection model is used. In each cluster, the power time series for a user is decomposed into trend, cyclical and residual components. Residual data, along with different features from multiple data sources, are fed in an ML classification algorithm to detect anomalous readings. Simulations have been conducted using a newly generated dataset and results have shown that the proposed model can detect electricity theft with high detection and low error rates. The results also shows that the proposed model can detect thefts with great accuracy from new users.