The first one is how easy it is to create a fake transaction and transmit it to the whole blockchain without it being instantly detected as fake.
There is one widely used scheme but it's not using a fake transaction (
can be used in that "every day spending" scenario).
It's done by utilizing "
replace-by-fee" flag which makes a transaction replaceable as long as it's not included in the blockchain yet (
0 confirmation).
However, such transactions can be easily identified so merchants that accept 0-confirmation (
eg. some Casinos) txns don't grant the benefit if it has an 'rbf' flag.
It goes like this: The transmitted "
unconfirmed" rbf flagged transaction will be seen by most clients and the victim,
but when the scammer wants to "
cancel" it, he just have to send another transaction transaction that spends the same input(s) and replace the output with his own address.
That essentially boots out the old transaction from most mempools.
Nodes with default setting are setup to replace the older transaction with rbf flag as long as the new transaction follow some specific rules.
BIP-0125:
https://github.com/bitcoin/bips/blob/master/bip-0125.mediawiki#Implementation_Details