If a transaction takes anywhere from around 10 minutes to hours to get written to a block and put on the chain
Just to have that said: if a proper fee is set, it can be ensured that the transaction will get confirmed within the next block.
Back to the question merit: Performing a double-spending attack is very costly after the transaction has been propagated through the network. There is some risk, but there is some also when accepting cash or credit cards and the vending machines can be often enough fooled with tokens resembling the weight and size of a real coin. There are places, both online and physical that accept small unconfirmed transaction if they are valid, have a proper fee and are already propagated.
Additionaly, there are services such as Coinbase, that additionaly verify transactions between their users. If the transaction occurs between Coinbase accounts, it can be even more sure to appear in the blockchain, even if it isn't yet confirmed.
1A vending machine doesn't have to worry about an attack that costs $50 to pull off. – David Schwartz – 2017-05-08T16:25:56.003
@DavidSchwartz, can you explain that attack in more detail, or point me to some references? – sager89 – 2017-05-09T16:11:35.123
Check here or punch "Finney attack" into your favorite search engine.
– David Schwartz – 2017-05-09T16:18:47.757