This question already has an answer here:
Step 1: User-1 initiates the TXN-1 to pay to User-2 and the TXN is not yet confirmed with the ongoing block POW.
Step 2: What prevents fraudster (anyone a miner or someone listening/participating in the network), to double spend or divert the payment to User-3 with a new TXN-2 by copying the data from pending TXN-1 including the User-1's signature?
Step 3: if the miners reject both TXN-1 and TXN-2 as a suspicious or double spend activity in the current block POW, what prevents the same fraudster to issue a new TXN-3 by copying the TXN-2 with the next block POW?
Thanks in advance.