Doorstep Password Schemes From Water and Energy Companies

A doorstep password is a word or phrase you give to your water and energy companies in advance. When someone from the company calls at your home, you ask for the password before you open the door or let them in. Water companies offer this so that you know who they are when they knock on your door¹, and energy suppliers run an ID and password scheme so you know whether it is really them if they contact you¹. The police say many service providers provide password schemes and that it can be helpful to sign up to them².

Setting one up is straightforward. The scheme sits within the Priority Services Register, which is offered by your energy supplier³, and joining brings other help besides the password, such as advance warning of planned interruptions to your supply⁴. If a caller cannot give your password, close the door and ring the company yourself on a number you look up, never a number the caller gives you⁵. If someone suspicious will not leave, Police Scotland's advice is simple: call 999⁶.

How the doorstep password scheme works

The scheme is a shared secret between you and the utility company. You choose a password and register it with the company. The company records it against your address. When a member of staff or a contractor needs to visit your home, whether for a meter reading, a repair or a planned interruption to your supply, they are told the password before they knock. You ask for it through the door, on the chain, or however you choose to speak to them, and only open the door when they say the right word.

Water companies use the scheme so that you know who they are when they knock on your door¹. Energy suppliers use an ID and password scheme so you know if it is really them if they contact you¹. The point in both cases is the same: a genuine caller has the password, and a bogus caller cannot have it, because they were never told.

Avon and Somerset Police note that many service providers provide password schemes and that it can be helpful to sign up to these². That means the scheme is not limited to one company or one kind of utility. If a company might legitimately call at your home, it is worth asking whether it runs a password scheme and registering one with each.

The password works alongside other checks, not instead of them. A genuine caller will expect to be asked and will not mind waiting while you verify them. Anyone who rushes you, objects to the question or claims not to know about the scheme is giving you a reason to close the door and check independently, which is exactly what the scheme exists to let you do safely.

Setting up your password: a word or phrase of your choosing

The password is yours to choose. Because you will need to say it to a caller, and a caller will need to say it back to you, it should be something you can remember and recognise instantly, without writing it down at the door. The National Cyber Security Centre's approach to memorable passwords works well here: combine three random words to create a single memorable password, for example CupFishBiro¹⁰. Essex Prepared gives the same advice for creating a password that is difficult to crack¹¹.

Keep this password separate from anything you use online. Avon and Somerset Police advise that passwords should be different from your previous passwords¹², and Police Scotland advise using different passwords for all online accounts¹³. A doorstep password is spoken aloud, sometimes on the doorstep in earshot of others, so treat it as its own thing and do not reuse a password that guards an account that matters.

If you find passwords hard to manage generally, the National Cyber Security Centre encourages people to use password managers, which can create strong passwords for you and remember them¹⁴. That is more useful for your online accounts than for a spoken doorstep password, but it frees you to concentrate on remembering the one word that matters at the door.

One practical point from the energy networks: SP Energy Networks asks customers to make sure their online account details with the company are up to date¹⁵. Keeping your contact details current with each supplier means the company can reach you before a visit, tell you who is coming, and make the password check a formality rather than a surprise.

Part of the Priority Services Register

For energy suppliers, the password scheme sits inside the Priority Services Register. The scheme is offered by your energy supplier³. Joining helps your utility companies to provide adapted services, adjust communications and make amendments to keep you safe, such as a password scheme and advance warning of planned interruptions⁴.

The register is not only for the password. An Ofgem consultation describes the password scheme as a measure to help customers identify energy company representatives, offered by suppliers, electricity distribution network operators (DNOs) and gas distribution networks (GDNs) to disabled customers, chronically sick customers and customers of pensionable age¹⁶. So the same password can cover visits from more than one part of the energy industry: the company that sells you energy and the network company that maintains the wires and pipes.

Checking eligibility is quick. Nottinghamshire County Council's advice is to check if you are eligible to register on your energy company's Priority Service Register¹⁷, and Fishguard and Goodwick Town Council point customers to a link to check whether they can go on their energy supplier's register¹⁸. If you live with someone who is older, disabled or chronically sick, register on their behalf as well as your own.

On who can see your information: Ofgem's view is that energy companies can share sensitive information about customers' circumstances where they have obtained customers' permission in the first instance, and that they should set up mechanisms to acquire and facilitate consent¹⁹. In plain terms, your permission comes first, and you control it through the consent you give when you join. Our extra help in an emergency page sets out the wider help the register brings.

Checking a caller is genuine: never use the number they give you

The password is your first check, but not your only one. Police Scotland's doorstep scam advice is to check a caller's credentials by phoning the company they represent or checking online, but never using contact details they give you⁵. The reason is simple: a bogus caller with a fake ID card can just as easily hand you a fake phone number, answered by an accomplice.

Police Scotland's Shut Out Scammers campaign makes the point directly about ID cards:

The same caution applies to your phone. Sussex Resilience Forum guidance warns that caller ID can be spoofed easily, so do not trust a displayed telephone number, and that your bank, the police, or real companies will never ask for your details in an email, text, or phone call⁷. Nottinghamshire County Council adds: never provide bank or card details to anyone who has contacted you unannounced²⁰.

A numbered routine for the door:

1. Keep the door on the chain, or speak through it, and ask for your password.
2. If the password is wrong or the caller hesitates, close the door.
3. Look up the company's number yourself, on your bill, its official website or an official phone directory⁸.
4. Ring that number and ask whether they have sent someone to your address.
5. Never ring a number the caller gives you, and never trust a number on a caller display⁵.

Some companies publish dedicated verification lines. Thames Water lists 080 031 9800 as a number householders can call²¹. In Northern Ireland, the Quick Check 101 scheme lets you phone 101, the police non-emergency number, to check the identity of callers to your home who claim to work for an energy or water network company⁹. Our page on how to check a doorstep caller is genuine goes through this in more detail.

Avon and Somerset Police add a rule that protects you after the door: never use companies that make unsolicited calls, do not provide written contracts or offer to do work for cash².

Signs of a bogus caller

The Police Service of Northern Ireland warns that bogus callers may pretend to be from utility suppliers and other reputable organisations in order to gain access to a property, and then steal money and valuables²². North Yorkshire's community risk guidance likewise tells residents to stay alert for hoax callers posing as utility company workers²³. The disguise is chosen precisely because a water or energy worker has a plausible reason to knock and to need to come inside.

The warning signs to watch for:

• The caller cannot give your password, or claims the scheme does not exist.
• They pressure you to hurry, or say the problem is urgent and must be fixed now.
• They object to you closing the door to verify them, or to you ringing the company.
• They ask for payment, bank details or personal information on the spot.
• They offer to do work for cash, with no written contract².
• They produce an ID card but want you to ring the number printed on it⁸.

Ofgem has acted on the scale of this problem. In November 2022 it wrote to all energy supplier chief executives asking them to have clear, up-to-date and accessible information on their websites advising customers what to do in case of a scam²⁴. That means your supplier's own website should tell you how its genuine callers identify themselves, and it is worth reading that page before you ever need it.

A genuine caller will wait. They expect the password question, they expect you to verify them, and they will not ask for money or bank details at the door. Anyone who does any of the things listed above should be treated as a bogus caller whatever they are wearing or carrying. Our bogus callers page covers the wider picture.

Scam texts and calls posing as utilities

The password protects your doorstep, but utilities are used as a disguise on the phone and in messages too. The National Cyber Security Centre's annual review records that cyber criminals used the energy regulator Ofgem as a lure for over 50 phishing campaigns used to harvest financial credentials²⁴. A message that appears to come from your supplier, or from the regulator, asking you to confirm account or bank details is a known and active pattern.

A parish council warning from April 2025 describes one such scam in detail: victims across the country reported receiving cold calls demanding payment or personal details under the guise of upgrading their landline service to "Digital Voice"²⁵. The same warning notes that criminals may use phishing emails, fake websites or phone calls to trick residents into providing personal information such as bank account details or passwords²⁵.

The rules that protect you are consistent:

• Never automatically click on a link in an unexpected email or text. Banks and financial institutions will never ask that of you as a way to verify your bank details²⁶.
• Your bank, the police, or real companies will never ask for your details in an email, text, or phone call⁷.
• Never provide bank or card details to anyone who has contacted you unannounced²⁰.
• Do not trust a displayed telephone number, because caller ID can be spoofed easily⁷.

If a text or call claims to be from your water or energy company and you want to check it, use the same method as at the door: hang up or ignore the message, look up the company's number yourself, and ring that. Our cyber attacks and major IT failures page covers what to do if you have already responded.

If a caller will not leave or pressures you: who to call

Most bogus callers leave when they realise you are checking them. Some do not. Police Scotland's advice on doorstep crime and bogus callers is that if someone suspicious will not leave, you should call 999⁶. Pressure, refusal to leave and attempts to push past you are matters for the emergency response, not for negotiation.

For everything short of that, 101 is the number to use. In Northern Ireland, Quick Check 101 exists precisely for this situation: you can phone 101, the police non-emergency number, to check the identity of callers to your home who claim to work for an energy or water network company⁹. The scheme includes all of Northern Ireland's energy and water network and supply companies: firmus energy, NIE Networks, Northern Ireland Water, Phoenix Energy, Evolve (previously SGN Natural Gas), Power NI, SSE Airtricity, Budget Energy, Click Energy, Electric Ireland and Share Energy⁹.

If you are unsure whether a situation is an emergency, our page on when to call 999 or 101 about a crime at home explains the difference, and what to do if a doorstep caller will not leave works through the steps in order. If a caller leaves but you believe they were bogus, report it: our how to report a bogus caller page explains how, and a report can protect the next street.

Why water companies are a favourite disguise

Utility companies give a bogus caller two things they need: a reason to knock and a reason to come inside. The Police Service of Northern Ireland warns that bogus callers may pretend to be from utility suppliers and other reputable organisations in order to gain access to a property, and then steal money and valuables²². A claim that there is a burst main, a gas leak or an emergency at the meter creates urgency, and urgency is the tool that stops householders checking.

Claims about water systems can sound especially alarming. In August 2022, South Staffordshire Water was targeted by ransomware actors who claimed to have accessed systems that control industrial processes at the company's water treatment plants²⁷. The claim was about the company's systems rather than your home, but it shows the kind of language that can be used to make a water emergency sound real and urgent. A caller at your door citing an urgent water problem should be treated exactly like any other caller: password first, verification second, door closed in between.

The defence is the same whatever the disguise. Your password is the one thing a bogus caller cannot produce, however convincing their uniform, van or ID card. If you have not set one up with your water company, do it before you need it, and see our water in an emergency page for what a real supply interruption looks like and how to prepare for one.

Related help for households that need it

The password scheme is one part of a wider set of arrangements for households that need extra support. The Priority Services Register, offered by your energy supplier³, brings adapted services, adjusted communications and amendments to keep you safe, including the password scheme and advance warning of planned interruptions⁴. Our extra help in an emergency page explains who qualifies and how to join.

Other measures work alongside it:

• A key safe can let carers and responders in without anyone having to answer the door, and police-preferred models are covered in which key safes are police preferred.
• The police advise that security lighting and CCTV can warn you of an intruder and alert neighbours and passing patrols²⁸, which helps the whole street when a bogus caller is working the area.
• A Neighbourhood Watch scheme spreads a warning quickly, particularly to older neighbours who are often targeted.
• If you live in Scotland or Northern Ireland, reporting routes and support differ: see Scotland and Northern Ireland: reporting crime and getting support.

Finally, if you have been targeted, say so. Reporting a bogus caller, even one who left empty-handed, gives the police the pattern that connects incidents across an area, and anonymous reporting is possible where you prefer not to give your name. The wider subject of doorstep crime, including rogue traders and your rights, is covered in our home security guide and in rogue traders and doorstep selling.