False Positives and False Negatives: Why Measuring Only Accuracy Is Not Enough

These two terms have long been overlooked in the tech and cybersecurity community, although interest has grown significantly in recent years: false positives and false negatives. It is far more common to hear discussions about accuracy and precision. Accuracy measures the system’s overall ability to make the correct decision (the global rate of correct matches when validating legitimate users and rejecting impostors), while precision measures the reliability of a positive result — the likelihood that a match flagged by the algorithm is real and not a false positive.

What Do False Positives and False Negatives Really Mean?

The core idea behind any identification system — whether facial biometrics, digital identity, INSS liveness checks, or customer onboarding — is simple: correctly recognize who the person is. In practice, this is far from trivial. Two fundamental concepts explain why: false positives and false negatives.

A false positive occurs when the system identifies someone as another person (meaning an impostor is accepted as if they were legitimate). A false negative happens when the system fails to recognize someone it should recognize (the real user is rejected). These errors are common in facial recognition technologies, especially in non‑ideal environments, such as poor lighting or when the algorithm has not been trained with enough diversity.

In other words: it is not enough to say a system has “high accuracy” (e.g., it gets 99 out of 100 decisions right). It is essential to understand how it behaves in extreme cases, exceptions, and real‑world scenarios.

Why Facial Recognition Does Not Work Perfectly in All Scenarios

The promise of facial recognition is appealing: contactless processes, speed, security, and automation. But the reality is that this technology still faces significant challenges.

Factors that degrade performance include:

• Poor lighting: Dark environments or excessive brightness distort facial features.
• Natural changes in the face: Aging, facial hair, makeup, glasses, cosmetic procedures, or even expressions affect results.
• Insufficient diversity in training data: Databases lacking demographic variety produce systems that work well for some groups and poorly for others.
• Presentation attacks (spoofing): Photos, videos, or masks can fool systems without strong liveness detection.

These are precisely the scenarios where false positives and false negatives become critical.

How Do False Positives and False Negatives Affect Biometric Enrollment?

Biometric enrollment should ensure that the person being registered is truly who they claim to be. But consider these situations:

False Positive During Enrollment

The system accepts a fraudster’s face as a legitimate customer. Consequences: fraudulent account creation, financial scams, identity theft, unauthorized access, and purchases made in the victim’s name.

False Negative During Enrollment

The system rejects a legitimate customer. Consequences: frustration, transaction abandonment, increased support costs, complaints, and loss of trust in the institution.

Both cases harm user experience and compromise security.

Impact on Liveness Checks and Digital Identity

In INSS liveness verification, a false negative may prevent a beneficiary from receiving payments. A false positive may allow someone else to impersonate the beneficiary, causing financial loss to both the system and the rightful user.

In digital identity, the impact is even greater: an error during onboarding can compromise the entire trust chain. If the system misidentifies a user at account creation, all subsequent transactions may be affected.

Modern technologies therefore incorporate robust liveness detection, ensuring a real person is in front of the camera and reducing risks from photos, videos, or deepfakes.

Why Measuring Only Accuracy Is Not Enough

Accuracy is seductive: “my system is 99% accurate.” But it hides critical nuances.

Imagine a system with 99% accuracy that still produces:

• 1% false positives in a bank with millions of customers
• 1% false negatives in a national liveness verification process

These 1% represent thousands of affected people.

Accuracy also fails to show:

• How the system behaves across demographic groups
• How it reacts to fraud attempts
• How it handles natural facial variations
• How it performs in real environments outside the lab

Cybersecurity professionals must look at metrics such as:

• FMR (False Match Rate) — false positives (also FAR – False Acceptance Rate)
• FNMR (False Non‑Match Rate) — false negatives (also FRR – False Rejection Rate)
• TPR / FPR — true positive and false positive rates
• ROC Curve — the balance between security and usability

Accuracy alone can mask severe failures, especially in imbalanced datasets. A system tested mostly with impostor attempts may appear highly accurate even if it rejects nearly all legitimate users. Additionally, biometric decisions depend on a similarity threshold: tightening it reduces false positives but increases false negatives, and vice‑versa. Even highly accurate models face this unavoidable trade‑off.

Need help understaing these concpets or how to measure them ? Contact a specialist.

Accuracy is only the surface. Security lives in the details.

How to Properly Measure False Positives and False Negatives

To measure these indicators, systems must be tested under varied conditions:

• Different environments: natural light, artificial light, low illumination
• Diverse users: age, gender, ethnicity, facial characteristics
• Fraud scenarios: printed photos, videos, deepfakes
• Real usage situations: movement, distance, urgency

Continuous evaluation is essential. Facial biometrics evolve, but so do attacks. What works today may fail tomorrow.

Why Every Cybersecurity Professional Must Master These Concepts

Modern digital security increasingly relies on biometrics, digital identity, and automated verification. Understanding false positives and false negatives is crucial because it:

• Helps identify vulnerabilities before fraudsters do
• Enables calibration of systems to balance security and user experience
• Prevents decisions based on incomplete metrics
• Ensures onboarding solutions are truly reliable
• Reduces risks in critical processes such as liveness checks and continuous authentication

In a world where contactless processes are becoming standard and digital identity is central, ignoring these concepts opens the door to serious failures.

How to Reduce False Positives and False Negatives in Practice

Strategies include:

• Improving algorithms with diverse datasets
• Implementing robust liveness detection
• Using multi‑factor authentication when needed
• Continuously monitoring system performance
• Adjusting thresholds according to operational risk (e.g., amusement park entry vs. bank vault access)

Each context requires a different balance.

Conclusion: Accuracy Is Only the Beginning

High accuracy does not guarantee security. Without understanding false positives, false negatives, liveness, secure onboarding, digital identity, and the real challenges of facial recognition, any biometric solution risks failing precisely where it must be strongest. Cybersecurity professionals must go beyond superficial metrics and evaluate the real‑world impact of these indicators on people, institutions, and critical processes.