It was my understanding that bitcoin transactions took about half an hour to clear? So how can they then say "The transaction happens instantaneously, EVR promises." Or, is this one of those things that has been fixed recently?
So, if I accept a bitcoin right away, I open myself up to a fairly trivial double-spend attack. If I wait for one confirmation, it's harder, but still sorta maybe doable. If I wait for several (1-2hours), it's near impossible.
Compare with taking cash which may be phony, or a CC which is easily charge-backable, and the business's risk is ... close enough to the same.
One confirmation, that is, being included in one block, takes anywhere from a few seconds to 15 minutes, probably averaging 5-7 minutes. With that, it's already virtually impossible to double-spend without having enough mining power to take 51% of the current mining network. That's a bit more hashing power than the entire current mining network combined. That'll earn you hundreds of thousands of dollars a day just doing honest mining, and potential double-spend activity well into the tens of millions or more. Again, why bother with that to rip off a $20 bar tab? Or even a $2,000 bar tab?
If we're talking values <$250 (an arbitrary number that I think is a "small" value for a business), you will be perfectly fine waiting only a few seconds for the transaction to go through.
However, there is a small risk of what is called a "double-spend attack". Basically, a criminal can send two Bitcoin transactions at once (one to the person they are paying and one to themselves). If they get lucky or can leverage a lot of computing power, they can make the person they are paying think they received their Bitcoins, but in the end, the attacker might be able to make the transaction in which they sent money to themselves go through first.
Thankfully, such an attack is rather hard to pull off. If an attacker sends two transactions at once, some clients can detect such an attack and display a notification within a few seconds of the transaction. It also takes some luck and computer skill. Basically, it's not a repeatable process that someone can get away with. The other way, involving lots of computing power, is very expensive to pull off and gets exponentially harder as time goes on, which is why it's not really a risk for small transactions.
So basically, there is a small risk of losing money if you only wait a few seconds, but almost no risk if you wait a few minutes. If my math is right, it takes, on average, 5 minutes for a block to confirm from any random point in time (if my math is right, which I'm not at all confident it is). So if I was doing a thousands-of-dollars transaction, I would wait for one block (5 minutes average? Someone check my math here), but if I was doing tens of thousands of dollars, I would wait for 3 blocks (closer to half an hour).