What is the false acceptance rate?
The false acceptance rate (FAR) measures how often a biometric system lets in someone it should have turned away. Every fingerprint, face or iris reader compares a fresh sample with a stored template and produces a similarity score. If the score clears the system's threshold, the reader declares a match. When the person at the reader is not the enrolled user and the reader matches them anyway, that is a false acceptance. FAR is the security error among the biometric rates: the wrong person gets in. Most security references, including Security+ study material, call a false acceptance a Type II error.
How FAR is calculated
FAR equals false acceptances divided by impostor attempts. Suppose a lab runs 20,000 trials in which volunteers present their own finger against someone else's enrolled template, and 4 trials produce a match. The FAR is 4 / 20,000, or 0.02 percent, about one impostor accepted in every 5,000 tries. Testing standards also define a closely related figure measured at the matching algorithm, the false match rate; product sheets and exam questions generally treat the two as the same idea.
What pushes FAR up or down
- The threshold. Demanding a closer match lowers FAR. Loosening it, often done to quiet complaints about rejections, raises FAR.
- One-to-many searches. A reader that compares a sample against every enrolled person, instead of against one claimed identity, risks a false match with each template. At a per-comparison rate of 1 in 100,000 and 10,000 people enrolled, an impostor has close to a 10 percent chance of matching somebody.
- Retries. Allowing three attempts gives an impostor three chances, so the effective FAR rises.
- Sample and template quality. Hurried enrollment and low-resolution sensors blur the differences between people.
Keeping false acceptances rare
High-security entry points, such as a data center cage, run a strict threshold and tolerate the occasional repeat scan by legitimate staff. Pairing the biometric with a second factor, such as a badge or PIN, means a false acceptance alone does not open the door, and presenting the badge first turns the check into a one-to-one comparison. FAR is measured against ordinary impostors, so a low published figure says little about deliberate spoofs, such as a silicone fingerprint or a printed photo; liveness detection handles those.
FAR vs. FRR vs. CER
- FAR: impostors accepted; a security problem.
- FRR (false rejection rate): legitimate users rejected; a usability problem, called a Type I error.
- CER (crossover error rate): the rate at which FAR and FRR are equal, used to compare products; lower is better.
Lowering FAR almost always raises FRR, because both depend on the same threshold and move in opposite directions.
False acceptance rate on the CompTIA Security+ exam
FAR is not on the SY0-801 acronym list. The idea is taught with biometrics, one of the multifactor authentication methods in objective 4.5, and scenario questions turn on it. Wording such as unenrolled visitors admitted, an impostor accepted or a reader that is too permissive points to a high FAR, and the fix is a stricter threshold or an added factor. The usual distractors are FRR, the opposite error, and CER, which describes the system as a whole rather than one kind of mistake.