An electricity theft is a problem for distribution system operators (DSOs) in Poland. DSOs use many ways to limit this unfavourable phenomenon. Within this paper, the author presents a new method to detect the location of illegal power consumption. The method bases on the processing of data from an advanced metering infrastructure (AMI). The method is based on the observation that some consumers illegally consume energy mainly in the winter season and that the level of illegal energy consumption may depend on the level of energy consumption. The method searches for periods of temporary reduction of the balance difference and a simultaneous decrease in energy consumption by one of the consumers.