Don't accept 0 confirmation tx

[RapTarX]

Check this thread- https://bitcointalk.org/index.php?topic=5279758.0
OP has been scammed because they accepted tx without a single confirmation. It's possible to manipulate a tx in such cases where scammer will send you the fund and make sure they have received what they have paid for and later they will create another tx with higher fee with the same input. The later tx will get confirmed and yours one will be invalid.
Therefore, don't accept zero confirmation tx. Wait for at least 1 confirmation.

[SquirrelJulietGarden]

It is very easy scam to be realized and I don't know why there are people who are scammed by this. I am sorry for the loss of that person but still don't understand why.

If a person actually uses an exchange, a casino, requirement on confirmations is a thing to know of. From 1 to 3 confirmations will be required. It is applied commonly to avoid double spend attacks.

I am sorry if a person is scammed by this for the first bitcoin transaction ever made. If it is not a first bitcoin transaction, I am sorry for the very careless acceptance.

With small fund, wait for 1 confirmation. With big fund, wait for up to 3 confirmations to make sure that transaction is irreversible. The most annoying issue is wait for first transaction. You don't know how long you will have to wait to see the first confirmation. Fortunately, after the first confirmation, it is comfortable to wait for next 20 minutes (longer or shorter a little) to get 2 more confirmations.

https://en.wikipedia.org/wiki/Double-spending
https://en.bitcoin.it/wiki/Irreversible_Transactions
https://academy.binance.com/en/articles/double-spending-explained

As we can see, a merchant that waits for block confirmations will vastly reduce the risks of becoming a victim of double-spends.

[Jet Cash]

I feel comfortable with 3 confirmations. Although I am so erratic at the moment, that it will probably be a lot more by the time I can check.

[Cadaver20]

This is called "double spend transaction". It is one of the way to scam people. We need to be more careful not to rush into dealing with strangers.  I always wait for the asset to be added to my wallet during this type of transaction.

[Upgrade00]

A lot of users of Bitcoin are unaware of what double spend is and wallets like electrum adds the unconfirmed transactions to their address as soon as it is sent, making it easier for them to be tricked that they have already received the funds in there wallet.

Therefore, don't accept zero confirmation tx. Wait for at least 1 confirmation.

The 1 confirmation rule is sufficient for smaller transactions; below ~$1,000. If however a transaction involves a significant amount ~ $100,00 to $1,000,000 6 confirmations would be advisable, for it to be considered irreversible, although in reality what it means is that, the transaction would be too expensive to invalidate and the scammer would be spending more than the amount involved to attempt such an attack on the network.

[sheenshane]

This reminds those Bitcoin enthusiasts to know how Bitcoin works properly before accepting Bitcoin as a payment. Yes, Bitcoin is irreversible once it is confirmed but it could be tricked by the double-spending method of scamming people if there's no at least 1 confirmation. I even not feel safe with one confirmation confirmed. For the sake of safety and security per Bitcoin transaction, at least 3-5 confirmation confirmed before accepting as a valid amount transfer to your wallet or even much better just wait for the minimum 6 confirmations.


source:

The rejected transaction was pulled by the network and mark as rejected. And that is could be you of you will not wait for even 3-5 confirmations to be processed.

[Yaseen Wallis]

This is a great tip and something that should apply to every cryptocurrency!
Bare in mind that some cryptos have a much, much faster blocktime and that period could be even longer.

[skarais]

Yes, I have read it and understand what the OP went through. To be honest I had never heard of a scam like this before and it was new to me. BTW you are a little faster than me to start thread, but good because the community will gain knowledge and warning.
I never knew before that the first transaction could still be transferred or canceled just because the sender made a second transaction with a higher fee. But that person's case has made me realize that unconfirmed transaction are anything but secure.

[RapTarX]

I never knew before that the first transaction could still be transferred or canceled just because the sender made a second transaction with a higher fee.

Imagine, you made a tx with lower fee. In recent times, lower fee tx requires more time to get confirmed. One of my tx with 2 sats per byte isn't confirmed yet. Nevertheless, since you used lower fee in the tx, the tx won't get confirmed. With the tx id, you were able to attract the mind of the seller (receiver) that you sent the tx. But since the tx isn't confirmed yet, if you create another tx with higher fee, miners will include the higher fee one in blocks. Therefore, the previous tx will no longer valid as that input has already been spent.

[hosseinimr93]

Imagine, you made a tx with lower fee. In recent times, lower fee tx requires more time to get confirmed. One of my tx with 2 sats per byte isn't confirmed yet. Nevertheless, since you used lower fee in the tx, the tx won't get confirmed. With the tx id, you were able to attract the mind of the seller (receiver) that you sent the tx. But since the tx isn't confirmed yet, if you create another tx with higher fee, miners will include the higher fee one in blocks. Therefore, the previous tx will no longer valid as that input has already been spent.

This doesn't always work. Because there is no guarantee that the new transaction will be accepted by nodes unless you are very very lucky.
Even you try to broadcast a new transaction spending same inputs with a much higher fee, there's a high probability that nodes reject the transaction and don't propagate it.
The scammer in question was very lucky or managed to make a double spend in a way I'm not aware of.
As far as I know, for having a successful double spend, it's not enough to make a new transaction with a higher fee. The transaction will be rejected by majority of nodes even if the first transaction hasn't been confirmed yet and the fee paid for the second transaction is much higher.

[Charles-Tim]

Normally, a hacker can use replace by fee or child pay for parent to divert the transactions of no confirmation from the recipient back into their wallet. That is why it is not good to accept zero confirmed bitcoin transaction. But, if a miner has picked the transaction already and confirmed ones (1 confirmation), it will be difficult or not possible to reverse such transaction back. But, no matter how low a transaction amount is, accepting zero confirmed transaction can later lead to the recipient being scammed by the sender.

For me, 1 confirmation is good on my side when transacting low amount of bitcoin, but for high amount of bitcoin, I will prefer 3 to 6 confirmations. But, I do not think transactions that have 1 confirmation already can be reversed but transaction with 3 to 6 confirmations is more secure.

[jossiel]

To be sure at least 1, 3 and there's even 6 confirmations that I've seen just to be sure. I feel bad for the guy on the other as he's been scammed and it was actually the intention of the guy that he dealt with.

I always wait for the asset to be added to my wallet during this type of transaction.

Not only added but still check if it's confirmed. There are wallets that makes us see that there's an amount that got in and sent even it isn't yet confirmed.

[hosseinimr93]

Normally, a hacker can use replace by fee or child pay for parent to divert the transactions of no confirmation from the recipient back into their wallet.

Replace by fee transactions can be abused. Because once you bump the fee the first transaction disappear and it is replaced by a new one. But I don't think child pay for parent method can be abused unless I am missing something.
Using CPFP method, you can only accelerate a transaction and it's impossible to reverse the transaction, remove it, change outputs, etc.

[khaled0111]

It is very easy scam to be realized and I don't know why there are people who are scammed by this. I am sorry for the loss of that person but still don't understand why.

Sadly, not everyone who uses bitcoin knows how it works. I know people who make dozens of transactions daily but they have no clue what confirmation means.

The most annoying issue is wait for first transaction. You don't know how long you will have to wait to see the first confirmation.

If you use a non-custodial wallet which accept spending unconfirmed balance then you don't have to wait for the transaction to confirm. Just create a CPFP transaction and make sure you use enough fees to cover for both transactions.

[pooya87]

I feel comfortable with 3 confirmations. Although I am so erratic at the moment, that it will probably be a lot more by the time I can check.

the number of confirmations on a transaction you decide is "safe" depends on a couple of factors. it can never be a fixed value. and you should never just chose a random number but instead learn what it really means and when/how can a transaction be reversed or has the risk of it.

1) zero confirmation has never been safe and will never be safe. period.

2) type of client you use (in simple terms the way you check how many confirmation the transaction has) plays a key role. a full verification node that is capable of actually fully verifying everything can be trusted a lot more than a SPV client because it can detect chain reorgs whereas the SPV client has no safe way of doing that for sure. so 3 confirmation for a full node user and 6 to 10 for SPV users could be safer.

3) network state is also an important factor to consider. 99% of the times there is nothing going on in bitcoin world. all miners and all nodes are in complete agreement and they are all following the same rules. in 1% of the times (maybe less) we have "updates" aka forks. for instance during 2017 where there was BIP148 split-risk, the BCash miner attack risk, during both hard and soft forks,... there was a chance of chain splits and reorgs hence a much higher number of confirmation were required. it can be anything north of 30. (example)

4) and finally the amount you receive. this doesn't concern regular users since it mostly about cost of 51% attack but if you were receiving millions of dollars worth of bitcoin, you'd want a lot more  confirmation on it than just 1.

[tranthidung]

I always wait for the asset to be added to my wallet during this type of transaction.

You need to be careful since some wallet show unconfirmed transaction and even count it towards final balance.

Thanks for the reminder. Some people do neither know nor pay attention on difference between Unconfirmed and Confirmed deposits. Some platforms show Unconfirmed transactions in account deposits and newbies can be trapped.

Binance is different, at least it only show deposits if the minimum confirmations are met. Unconfirmed transactions won't be shown in Deposit history and Account balance of course.

Withdrawal: I don't remember that Binance only shows txhash of withdrawal after the transaction gets enough confirmations or at least 1. The txhash link is delayed for a while (always) but I know platforms always do patch payment so it takes a while to process customers' withdrawal request. Someone please confirm it. 
Personally, when I need to make transaction follow-up, I'd like to do it with block explorer and with Tor browser.

Connect wallets too often with Internet and nodes is not good, if I don't need to make any transaction. Let's consider with 2 situations:

• Incoming transactions (I plan to use it instantly when I receive it): two options: block explorer + Tor browser; with real wallet or account. It is less harm to use the first option.
• Sendout transactions: I always check it with block explorer + Tor browser. There is no need to connect my wallet to follow-up send-out transactions.

[Assface16678]

I think this is the common problem with us OP of the link above getting too much confidence because the mode of payment is on BTC and I think he thing once you already send the funds you are now safe. This is the common mistake right now because the scammer tricked him with the use of the double-spend.

I think they don't have communication right now of the scammer feels sad to him because all of the hard work becomes a scam.

. Also, you have a blockchain for checking the transaction also try to visit the mempool to check when is the right time to make a faster transaction because the miners are active.

Code:

https://www.blockchain.com/
https://mempool.space/

Also, I always visited the mempool every time to make transactions of the miners see good right now before making any transactions. The good thing and lesson this too to other members always wait for the confirmation before making a deal.

[UserU]

Also, I always visited the mempool every time to make transactions of the miners see good right now before making any transactions. The good thing and lesson this too to other members always wait for the confirmation before making a deal.

Fancy having to wait 10 mins after ordering in BTC for a cup of coffee while the rest wait in line, feels long man.

[bob123]

Fancy having to wait 10 mins after ordering in BTC for a cup of coffee while the rest wait in line, feels long man.

There are multiple ways to circumvent that.
You could either only allow 0-conf transactions if they are send without the RBF flag which makes it much harder (not impossible) to double spend a transaction. That's definitely fine for low value (coffee) transactions.
Another option would be to use a 2nd layer (e.g. lightning network). And the 3rd option would be to simply accept the risk. I mean.. it's just a coffee. Who is gonna steal a coffee. And even if there is someone who does exactly that, you might have some cameras to prohibit him entering the building again.
Losing one out of a few hundred coffees to a double spend isn't too much and definitely manageable.

[joniboini]

Fancy having to wait 10 mins after ordering in BTC for a cup of coffee while the rest wait in line, feels long man.

Just don't use it to buy a cup of coffee then. Why would you need main chain security when you can simply use your card or second layer solution as mentioned above?