What Is Zero-Confirmation Crypto Payment?

The Replace-by-Fee Attack

The primary risk in accepting a zero-confirmation Bitcoin payment is the Replace-by-Fee (RBF) mechanism. RBF, standardised in BIP125, allows a sender to replace an unconfirmed transaction in the mempool with a new transaction that pays a higher fee, as long as the new transaction signals RBF eligibility. An attacker can broadcast a payment to a merchant, receive goods assuming instant acceptance, then immediately broadcast an RBF replacement that sends the same funds back to themselves at a higher fee — effectively double-spending.

Bitcoin wallets that opt into RBF by default — including many modern wallets including those built on Bitcoin Core — signal this capability in the transaction itself (by setting the nSequence field). Gateways monitoring for RBF signals can identify RBF-eligible transactions and decline to accept them at zero confirmations. Non-RBF transactions have a higher bar for replacement, though they can still theoretically be replaced under certain conditions. Some Bitcoin forks, such as Bitcoin Cash and Bitcoin SV, have removed RBF from their protocol, making 0-conf significantly safer on those networks.

Networks Where Zero-Confirmation Is Safer

When Payment Gateways Offer Zero-Confirmation Acceptance

Some payment gateways offer configurable zero-confirmation acceptance for merchants who need instant checkout experiences — primarily in physical retail, vending, or micro-payment contexts. This feature typically comes with strict conditions: a maximum transaction value cap (often €10–€50), automatic RBF detection with rejection of RBF-signalled transactions, mempool monitoring for conflicting transactions from the same input UTXOs, and clear merchant terms stating that 0-conf acceptance is at the merchant's risk for fraud losses.

The expected fraud loss at 0-conf for Bitcoin at small values is low enough that many merchants treat it as an acceptable operational cost — similar to accepting the risk of counterfeit small-denomination bills in cash transactions. The economics of mounting a double-spend attack on a €5 coffee purchase are unfavourable for the attacker: successful attack requires precise timing, technical capability, and the reward is trivial. The practical risk is therefore lower than the theoretical vulnerability suggests.

Lightning Network as the Alternative

The Lightning Network solves the 0-conf problem entirely for Bitcoin micropayments. Lightning payments are final the moment they complete — the HTLC mechanism guarantees atomicity, and there is no possibility of replacement or double-spend once the payment is settled. For merchants who need Bitcoin instant payments, Lightning is a technically superior alternative to 0-conf on-chain payments: genuinely instant, cheaper in fees, and not subject to any double-spend risk. The operational requirement is integrating Lightning payment channels, which payment gateways abstract away for merchants.

Compliance Note: This glossary entry is provided for general educational purposes only and does not constitute financial, investment, legal, or tax advice. Industry terminology may vary across jurisdictions and providers; definitions herein may not directly reflect the specific features, terms, or specifications of Finassets' services. For details on Finassets' offerings, please refer to official product documentation or contact our team directly.