Yes, it is possible to make such a transaction. It's possible to make all kinds of transactions. Of course, it's much more interesting whether such a transaction would be valid. And it would. A requirement for a valid transaction is that the money that goes into it is at most as much as leaves it. The difference between what goes into a transaction and what leaves it is called a fee. The fee can be 0.
However, that such a transaction would be valid doesn't mean it will be confirmed, as you already suspected. But to defraud someone who accepts zero-confirmation, they need to at least know of the transaction. This is going to be difficult if you don't include a fee: https://bitcoin.org/en/glossary/minimum-relay-fee
The sender then can send a different transaction spending the money. Such a double-spending transaction usually will not be propagated much if some significant amount of time passed before the double-spending transaction was made public because nodes usually don't propagate transactions if they spend funds a different transaction in their mempools already attempts to spend. However, if the first transaction had a very low fee, a lot of nodes did not even add it to their mempools, meaning they don't remember the first transaction. Furthermore, some may store and/or propagate double-spending transactions if the fee of the second one is higher that the fee of the first one.
There are 3 ways to defend against this.
The first one is obvious: Don't accept zero-confirmation transactions.
The second one is to listen to an alarm which goes off as soon as a double-spending transaction has been found.
The third one is to only allowed zero-confirmation transactions from people you can identify. For example, an online shop may accept zero-confirmation transactions without worrying about them much as they know where the people they send their goods to live.
If you should have received money but a double-spending transaction made it into the blockchain instead, you don't own that money. Who owns which money is defined by the longest valid blockchain and if a conflicting transaction is in there, the one sending money to you can't get into it, too.