How Do Zero-Confirmation Transactions Increase the Vulnerability to a Double-Spend?

Zero-confirmation transactions, which are accepted immediately upon broadcast without waiting for a block confirmation, are highly vulnerable to double-spend attacks. The attacker can quickly broadcast a transaction to a merchant or exchange and, almost simultaneously, broadcast a conflicting transaction with a higher fee to the miners.

The miner is incentivized to include the higher-fee transaction in the next block, effectively invalidating the zero-confirmation transaction. This "race attack" is a common form of double-spend against services that accept unconfirmed transactions.