<p>Double spend attacks are possible in person just as they are online.  These attacks aren't actually spending the same coins twice on the blockchain, but rather tricking a retailer into <em>thinking</em> a transaction is valid for long enough to get away with the good.</p>

<p>However, setting up such an attack in non-trivial.  It becomes even more difficult if the retailer is checking for the items listed in <a href="https://bitcoin.stackexchange.com/a/60528/24974">@Andrew's answer</a>.  As such, purchases under a certain amount simply aren't worth a crook's time in setting up a double spend attack, and probably aren't worth a retailer's time protecting against one.</p>

<p>Consider how things work with retailers who accept card payments.  Starbucks is known for not requiring signatures for credit card payments that are under a certain amount.  If you don't know, signing a receipt on a credit card payment is a legal way of transferring the liability of fraud.  If a signature is obtained (even if forged), the liability is on the issuer of the card.  If a signature is not obtained, the liability is on the retailer.  Starbucks has decided that it is in their best interest to accept the liability of fraud because requiring a signature from each customer would slow down their lines and they would make less profit.  The cost of the inevitable fraud (to which they are liable for not requiring a signature) is lower than the potential profits they make from increased customer throughput.  Fraud isn't eliminated, but mitigated.</p>

<p>Accepting bitcoin is no different.  Depending on the price of the goods you are selling and the cost to your business of preventing double spends, each retailer needs to mitigate this fraud accordingly.</p>

CC BY-SA 3.0
2017-10-10T20:43:25.307Z
2017-10-10T20:43:25.307Z
Jestin
<p>Double spending attacks can certainly happen in person. A customer could have set up a system on a different computer which they remote into on their phone to initiate a double spend attack. However double spends can really only exist under certain conditions, so if you are planning on accepting unconfirmed payments, you should check that those conditions do not exist. This gives you a higher confidence in that transaction confirming. </p>

<p>You should make sure that the transaction does not have:</p>

<ul>
<li>A low transaction fee</li>
<li><a href="https://github.com/bitcoin/bips/blob/master/bip-0125.mediawiki" rel="nofollow noreferrer">BIP 125</a>'s Opt in RBF flag set</li>
<li>A locktime that is in the future</li>
<li>Spending from any unconfirmed transactions</li>
<li>Is unusually large (e.g. several kilobytes)</li>
</ul>

<p>If you check for these things and they are not in a transaction, you can be reasonably confident that the transaction will confirm.</p>

<p>You can also have a system set up to immediately perform a Child-Pays-For-Parent transaction so that you can ensure that the transaction has enough transaction fee to be confirmed. Note that if the transaction is Opts into RBF, this method may not work.</p>

CC BY-SA 3.0
2017-10-13T12:19:07.020Z
Thank you for the awesome answer! Just to clearify, is there any way in which I can calculate the minimun fee amount (so I can check if the payed fee is really too low)?
user3785008
CC BY-SA 3.0
2017-10-13T14:34:22.800Z
There is no minimum fee amount. You can use sites like http://bitcoinfees.21.co/ and https://bitcoinfees.github.io/ or Bitcoin Core's fee estimator to see what a fee rate for something to confirm within some acceptable window of blocks for you (e.g. 20 blocks) and see if the fee rate paid in a transaction is more than what the estimator suggests for your window.
Ava Chow
CC BY-SA 3.0
2017-10-18T16:51:19.060Z
Thank you Andrew, that's exactly what I was looking for!
user3785008
CC BY-SA 3.0
2017-10-10T20:22:10.610Z
2017-10-10T20:22:10.610Z
Ava Chow
<p>If I'm planning to accept in-person payments in a store, is it negligible a double-spending attack or isn't it too hard to do?</p>

<doublespend>
Is in-person double-spending attacks negligible on bitcoin payments?
user3785008
# Is in-person double-spending attacks negligible on bitcoin payments?

(Asked by: username_0 on 2017-10-10)

If I'm planning to accept in-person payments in a store, is it negligible a double-spending attack or isn't it too hard to do?

**Tags:** doublespend


---

## 2 answers

### Answer by username_2 on 2017-10-10. Score: 4 | Accepted answer

Double spending attacks can certainly happen in person. A customer could have set up a system on a different computer which they remote into on their phone to initiate a double spend attack. However double spends can really only exist under certain conditions, so if you are planning on accepting unconfirmed payments, you should check that those conditions do not exist. This gives you a higher confidence in that transaction confirming.

You should make sure that the transaction does not have:

* A low transaction fee
* [BIP 125](https://github.com/bitcoin/bips/blob/master/bip-0125.mediawiki)'s Opt in RBF flag set
* A locktime that is in the future
* Spending from any unconfirmed transactions
* Is unusually large (e.g. several kilobytes)

If you check for these things and they are not in a transaction, you can be reasonably confident that the transaction will confirm.

You can also have a system set up to immediately perform a Child-Pays-For-Parent transaction so that you can ensure that the transaction has enough transaction fee to be confirmed. Note that if the transaction is Opts into RBF, this method may not work.

> **Comments:**
> **username_0**: Thank you for the awesome answer! Just to clearify, is there any way in which I can calculate the minimun fee amount (so I can check if the payed fee is really too low)?  
> **username_2**: There is no minimum fee amount. You can use sites like http://bitcoinfees.21.co/ and https://bitcoinfees.github.io/ or Bitcoin Core's fee estimator to see what a fee rate for something to confirm within some acceptable window of blocks for you (e.g. 20 blocks) and see if the fee rate paid in a transaction is more than what the estimator suggests for your window.  
> **username_0**: Thank you Andrew, that's exactly what I was looking for!  

---

### Answer by username_1 on 2017-10-10. Score: 3

Double spend attacks are possible in person just as they are online. These attacks aren't actually spending the same coins twice on the blockchain, but rather tricking a retailer into *thinking* a transaction is valid for long enough to get away with the good.

However, setting up such an attack in non-trivial. It becomes even more difficult if the retailer is checking for the items listed in [@Andrew's answer](https://bitcoin.stackexchange.com/a/60528/24974). As such, purchases under a certain amount simply aren't worth a crook's time in setting up a double spend attack, and probably aren't worth a retailer's time protecting against one.

Consider how things work with retailers who accept card payments. Starbucks is known for not requiring signatures for credit card payments that are under a certain amount. If you don't know, signing a receipt on a credit card payment is a legal way of transferring the liability of fraud. If a signature is obtained (even if forged), the liability is on the issuer of the card. If a signature is not obtained, the liability is on the retailer. Starbucks has decided that it is in their best interest to accept the liability of fraud because requiring a signature from each customer would slow down their lines and they would make less profit. The cost of the inevitable fraud (to which they are liable for not requiring a signature) is lower than the potential profits they make from increased customer throughput. Fraud isn't eliminated, but mitigated.

Accepting bitcoin is no different. Depending on the price of the goods you are selling and the cost to your business of preventing double spends, each retailer needs to mitigate this fraud accordingly.


---

