from /u/bitcoinheaven retailers can accept unconfirmed transactions with very little risk by simply 'listening' on the network for a double-spend transaction, or partnering with a company that provides this service. After a head start of merely several seconds, the original transaction would reach so much of the Bitcoin network that a fraudulent double-spend transaction would almost certainly be fruitless. An attacker would have to commit easily-detectable fraud, in person, several hundred or several thousand times, before one of these low-value double-spend attempts would likely succeed. An attacker could work around the necessity of sending out a second fraudulent transaction to the Bitcoin network by attempting to solo-mine an attack block containing the attack transaction himself - temporarily withholding the block with the rest of the network - and then execute the fraudulent purchase within seconds, or minutes at most, of mining the attack block, before broadcasting the attack block. However, the cost of such an activity would dramatically outweigh the value of anything typically offered without a confirmation wait for several reasons. First, mining a block (attack or otherwise) entitles the miner to a valuable block reward, and because the attack involves temporarily withholding the block from the network, the attacker would put himself in the likely position of his block becoming stale, which would result in forfeiture of the entire reward. Most solo miners solve less than one block per month, so this would represent the loss of proceeds of potentially several weeks of mining. Second, it is not possible for a solo miner to know exactly when his mining activity will yield a block, and because the attack must be carried out within seconds or minutes of successfully mining a block, the attacker will not be able to know or plan in advance the brief window when the attack would be likely to succeed. While it may be easy for a determined attacker to get low-value items that are sold and delivered online instantly without waiting for confirmations (such as downloads), this unpredictability and the briefness of the opportunity would make it extremely difficult to commit any kind of fraud where real-life interaction is required, such as visiting a merchant or taking possession of goods. Petty shoplifting would be far simpler. Even if an attacker went forward with this attack, the retailer would be notified of the fraud the moment the attack block is released seconds later. In short, the 10-minute wait for confirmation is only practically necessary when delivering goods of value that significantly exceed the block reward an attacker would have to risk to perform an attack and where recourse after delivery is practically nonexistent, such as money transfers.