User A pays for the item with BitCoins, How long does it take for User B to verify that the payment was received?
As soon as the spend transaction is broadcast to a node's peers that it has a connection to, the transaction will propagate to nearly all nodes globally within seconds. Some will get it within a fraction of a second, for others it may take five or fifteen seconds before they learn of the transaction (and some nodes could be longer even)
But there's a chance that the message is deceiving. If the party that sent the payment it is attempting to cheat you, there are ways that you would think there was a payment but then later learn tht the funds never did confirm.
To protect against this, some merchants only recognize six confirmations as a completed transaction before crediting the recipient's account. Six confirmations is the number that makes it essentially impossible for the transaction to be reversed later.
Now because this can take an hour or more for six confirmations to occur, some merchants may treat transactions with fewer confirmations as being paid simply to improve the buying experience.
An exchange where an anonymous party is transacting from a remote location would not want to use below six. But others, like an e-commerce site, might be fine with fewer and a convenience store might be fine requiring none.
The level that would be appropriate depends on a few factors. There are various types of attacks that confirmations will protect against:
-
http://en.bitcoin.it/wiki/Double-spendingTake the race attack. The motive for the thief considering this is to obtain goods without paying. Visiting a retail location gives up evidence -- the party is identifiable, possibly through a security video camera. The merchant may not know that the transaction was a double spend until the thief is gone, but there is evidence to use to pursue the thief.
If the chance of getting caught doesn't dissuade the thief, then there is another hurdle. The success of a double spend attempt is low, as long as the merchant takes basic precautions (no incoming connections, explicit outgoing connections to well connected nodes). So if the success rate is one in twenty, the merchant's sees profits from normal sales on the 19 attempts that failed. Those profits might exceed the loss even if one attempt does succeed. So basic economics will prevent the thief from trying this as well.
Now if instead you had an unattended change machine at a laundry mat, where there is no profit or only a low profit from the exchange, the situation is different. For that, the thief would continue double spend attempts until successful. To protect against getting caught perhaps the thief uses a disguise. So in that instance Bitcoin doesn't work unless the trade doesn't complete until the transaction has multiple confirmatioins.
Credit cards don't technically settle where there is no reversal for three months or more, but merchants still accept them. They manage the risk.
The double spend risk for Bitcoin can be managed as well for the instances where six confirmations (one hour) is not fast enough.
