Z Score Outliers: Detecting Outliers with Z Scores
The z score outlier rule is the simplest detector in statistics: standardise every value, and flag any whose z score is extreme — beyond 2, 2.5 or 3 standard deviations, depending on how strict the field is. Here is how to run it, and where it breaks.
The method, step by step
- Compute the mean and standard deviation of the dataset (use the sample standard deviation s for sample data).
- Standardise every value with z = (X − x̄) / s, using the calculation routine until it is automatic.
- Flag by your threshold. |z| > 3 is the classic rule; many labs and social-science fields use 2.5; quick data-cleaning passes often use 2. The threshold is a policy choice — state yours when you report.
- Investigate before deleting. A flagged value is a question, not a verdict: entry error, unit error, a genuinely different sub-population, or a real extreme event all look identical to the detector.
Worked detection — test scores, mean 70, standard deviation 8
A score of 98 gives z = (98 − 70) / 8 = 3.50 — flagged at every threshold. A score of 45 gives z = (45 − 70) / 8 = −3.125 — also flagged, on the low side; outliers are two-tailed by nature. A score of 88 gives z = 2.25: flagged only under the loosest (2.0) rule, a reminder that borderline flags are threshold artefacts, not discoveries. Under a true normal distribution, |z| > 3 should occur about 0.27% of the time — roughly 1 in 370 values — so in a dataset of 100, even one such value already asks for an explanation. The areas behind those odds are on the area under the normal curve page.
Choosing a threshold honestly
The thresholds correspond to tail areas, and choosing by area is choosing by false-alarm rate. |z| > 2 flags 4.55% of perfectly normal data — in a dataset of 10,000, about 455 false alarms. |z| > 2.5 flags 1.24%; |z| > 3 flags 0.27%; |z| > 3.5 flags 0.047%. Large datasets therefore need stricter thresholds, and high-stakes contexts (fraud, safety) accept looser ones deliberately. What is not defensible is tuning the threshold after seeing which values it catches, in order to remove an inconvenient point: that is how analyses quietly become fiction. Fix the rule first, then apply it — the same discipline as choosing a test's tails before seeing data, discussed on the z score to p value calculator page.
Where the z score method misleads
- Masking. Outliers inflate the standard deviation, which shrinks their own z scores. Two extreme values together can pull s up enough that neither reaches 3. The robust fix is a median-based detector (median absolute deviation), or the IQR fence rule, neither of which lets suspects judge themselves.
- Skewed data. The rule assumes approximate normality. Incomes, reaction times and counts are right-skewed: their honest high values routinely earn z > 3 and are not errors. Transform first (log scales) or use a method designed for skew.
- Small samples. With n = 10, the maximum possible |z| is bounded (about 2.85), so a 3.0 threshold can never fire. Thresholds must shrink with n, or the method silently does nothing.
- Deleting by default. Sometimes the outlier is the finding — the fraudulent transaction, the failing batch, the record-breaking athlete. Flag, investigate, document; delete only with a recorded reason.
Frequently asked questions
What z score counts as an outlier?
Most commonly |z| > 3 (either tail). Fields that screen aggressively use 2.5, and exploratory data cleaning sometimes uses 2. There is no single official line; there is only a stated threshold, applied consistently, with its false-alarm rate understood: 0.27% at 3, 1.24% at 2.5, 4.55% at 2.
Can an outlier have a negative z score?
Yes — outliers are about distance, not direction. z = −3.125 is as extreme as z = +3.125. Low-side outliers matter as much as high ones (defects, fraud and failures usually live in one particular tail, and it is often the low one).
Should I use the z score rule or the IQR rule?
For roughly normal data, the z rule is fine and more interpretable. For skewed data or data that may already contain outliers, the IQR fence (1.5 × IQR beyond the quartiles) is more robust because quartiles barely move when extremes are added. Many analysts run both and investigate whatever either flags.
What do I do with a value I have flagged?
Check it against the source first — most flagged values in practice are entry or unit errors. If it is genuine, keep it and say so in the report, or analyse with and without it and show both results. Silent deletion is the one option that is never acceptable.