In this paper we study the security of demand response programs under false load control signals. We show how an attacker can defraud demand response programs by sending false load control signals and how it can make difficult the precise identification of the culprit. We analyze ways to detect attacks, and propose ideas to design the market in a way that attackers will not have an incentive to defraud the system.