FAR is the False Acceptance Rate, how often the wrong person is accepted; FRR is the False Rejection Rate, how often the right person is rejected. The two move in opposite directions as you set the threshold, and choosing where to sit on that trade-off is the operator's call.
What are FAR and FRR, in plain English?
Biometric systems do not return a clean yes or no. They compare a captured trait to a reference and produce a similarity score, and you decide how high that score must be to count as a match. Because no biometric is perfect, two kinds of mistake are always possible. A false acceptance is when an impostor scores high enough to be let in as someone else. A false rejection is when the genuine person scores too low and gets turned away.
FAR, the False Acceptance Rate, measures how often impostors are wrongly accepted. FRR, the False Rejection Rate, measures how often genuine users are wrongly rejected. They are the two error columns of any matching system, and they are governed by a single dial: the match threshold you set. Move the dial and both rates move, but in opposite directions, which is the whole reason these numbers matter.
In fraud and identity work, FAR is your security exposure and FRR is your friction and lost-customer exposure. A high FAR means more fraudsters slip through. A high FRR means more real customers get blocked, abandon onboarding, or flood your support queue. There is no threshold that zeroes out both, so the job is to choose the operating point that fits the value at risk.
The threshold trade-off
What changes | Loose threshold | Strict threshold |
FAR (impostors let in) | Higher; more fraud slips through. | Lower; fewer impostors accepted. |
FRR (genuine users blocked) | Lower; smooth for real customers. | Higher; more genuine users rejected. |
Friction | Low; easy to pass. | High; more retries and support load. |
Best fit | Low-value, low-risk flows. | High-value or high-assurance flows. |
Main risk | Impostor fraud gets through. | Lost customers and abandonment. |
What it looks like in practice
In practice
A neobank ships face verification at onboarding with the threshold set loose, to keep sign-up smooth. Conversion looks great, but a review finds that impostors using look-alike accomplices and decent spoofs are getting accepted more often than expected. The loose setting bought low FRR at the cost of a FAR the fraud team cannot live with.
The team tightens the threshold. Impostor acceptances drop sharply, but now more genuine customers fail on the first try, retry, and some abandon, and the support queue grows. The compromise is to set the threshold by the value at risk: strict for account recovery and high-value actions, looser for low-risk browsing, and to pair a middling threshold with a step-up rather than an outright block. They also break the error rates out by demographic and find the model rejects one group more often, a skew they then work to correct.
Why FAR and FRR matter to operators
These two numbers are how you translate a biometric system into business terms. FAR maps to fraud losses and security risk; FRR maps to abandoned onboarding, lost revenue, and support cost. Picking a threshold is not a technical afterthought, it is a policy decision about how much impostor risk you will accept to keep genuine customers moving, and it should be set deliberately per flow rather than left at a vendor default.
Two habits keep this honest. First, tie the threshold to the value at risk: a password reset on a high-value account deserves a stricter setting than a low-stakes action, and a step-up can catch the middle ground without a hard block. Second, monitor error rates across demographic groups, because a model with uneven performance can quietly reject certain populations far more often, which is both a fairness and compliance problem and a source of avoidable customer loss.
What to watch for
- Vendor-default thresholds. A setting left untuned rarely matches your value at risk, leaking impostors or rejecting good users.
- Demographic skew. Error rates that differ by group signal bias that harms specific populations and creates compliance exposure.
- FAR without liveness. Reported acceptance rates mean little if spoofs and injections can produce a match, so read FAR alongside spoof resistance.
- Rising abandonment. A jump in onboarding drop-off after tightening usually means FRR climbed and is costing real customers.
- One threshold everywhere. Using a single setting across low and high-risk flows wastes friction in one place and security in another.
Quick questions
Why can't you minimize FAR and FRR at the same time?
Because they are governed by the same threshold and move in opposite directions. Tightening to cut false acceptances raises false rejections, and loosening to cut rejections raises acceptances. You choose an operating point on that curve rather than eliminating both errors.
What is the equal error rate?
It is the threshold where FAR and FRR are equal, often used as a single benchmark to compare systems. It is a useful summary of overall accuracy, but real deployments rarely sit there, since you usually weight one error more heavily based on the flow's risk.
How do I choose a threshold?
Anchor it to the value at risk and the friction you can absorb. High-value or recovery flows justify a strict setting that accepts more false rejections. Low-risk flows can run looser. A step-up verification lets you handle the middle without hard-blocking genuine users.
Do FAR and FRR account for spoofing?
Not directly. They measure matching errors between genuine users and impostors, typically assuming honest attempts. Presentation attacks like photos, masks, and injected video are measured separately by spoof and liveness metrics, which is why FAR should always be read alongside spoof resistance.
Why monitor error rates by demographic?
Because biometric models can perform unevenly across groups, rejecting some populations far more often. That skew is a fairness and compliance risk and quietly loses genuine customers. Breaking FAR and FRR out by demographic surfaces the problem so you can correct it.
Is a low FAR always better?
Not unconditionally. Driving FAR very low usually pushes FRR up, blocking more genuine users. The right FAR depends on the stakes: strict where fraud is costly, more relaxed where friction hurts more than the fraud it would prevent.
Go deeper
- NIST Digital Identity Guidelines (SP 800-63) ↗ — The US standard for identity proofing and authentication assurance levels.
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.