Customer Friction and False-Positive Measurement

Back to learning

Account protection has two failure modes. The obvious one is letting attackers through. The quieter one is blocking, challenging, or delaying legitimate customers so often that the control becomes part of the problem.

That is why account-protection metrics need to measure both harm and friction.

Security metrics are not enough

Blocked requests, challenge counts, and suspicious sessions can be useful, but they are not the whole story. A control can block a lot of traffic and still be wrong if it mostly catches legitimate users, search engines, partner systems, or mobile customers behind shared networks.

Better security metrics include:

• Confirmed account takeover
• Fraud loss or avoided loss
• Sensitive actions held or reversed
• Exposed credentials found during attacks
• Tokens revoked after suspicious use
• Time from first signal to containment
• Repeat attacks on the same route or account group

These metrics connect the control to actual outcomes, not just activity.

Friction metrics complete the view

Useful friction metrics include:

• Challenge rate by route and user segment
• Challenge pass and fail rate
• Login or checkout abandonment
• Password reset completion time
• Recovery support tickets
• False-positive blocks
• Manual review backlog
• Customer complaints after security actions

If a new rule reduces abuse but doubles support tickets, the team needs to know. The answer may still be to keep the rule, but tune thresholds, change the action, add a clearer recovery path, or apply the rule only on higher-risk flows.

Measure by flow

Global averages hide the tradeoff. Break measurement down by account-control flow:

• Login
• Password reset
• Recovery and support override
• MFA or passkey change
• Session refresh
• Payment or payout change
• Data export
• API key or service-token creation
• Admin role change

A strict rule may be acceptable on payout changes and too aggressive on ordinary browsing. A challenge may be acceptable after exposed credential evidence and too disruptive on every new device.

Use review outcomes

False positives need a feedback loop. Support appeals, manual review results, fraud confirmation, and customer complaints should feed back into policy tuning. Without review outcomes, teams only see the action taken, not whether it was right.

Operators should be able to answer:

• What evidence caused the action?
• Was the action proportionate to the route?
• Did the customer have a clear path forward?
• Was the decision reversed?
• Did the attacker move to another flow?

The goal is not zero friction. Some friction is appropriate when the action can change account control, money, or data. The goal is proportionate friction: enough to slow abuse, not so much that legitimate customers carry the cost of unclear evidence.