In Bitcoin, 6 confirmations are considered secure (very low probability of transaction/block reversal).
What is the current number in Ethereum?
From George Hallam:
12 confirmations; however, exchanges and entities handling very large amounts of Ether frequently are still encouraged to run two different Ethereum implementations and only accept transactions that have been confirmed by both for maximum security (e.g. Go & C++).
For reference, 12 confirmations is approximately 3 minutes.
The geth client waits 5 blocks for confirmation of fresh minted blocks (around 1 minute).
I0201 19:07:07.354260 9098 worker.go:349] 🔨 Mined block (#1483 / a2648b58). Wait 5 blocks for confirmation
To make sure a block is no uncle or a transaction included in a block does not hang up in an ommer, I would suggest waiting 7 confirmations (around 2 minutes). From the whitepaper:
An uncle included in block B must have the following properties: [...] It must be a direct child of the kth generation ancestor of B, where 2 <= k <= 7. [...]
Miners need to check the parameters of the last 250 blocks. If you want to be on the most secure chain, with all feet on the ground, do it like the miners and wait for 250 confirmations (around 1 hour).
Some exchanges practice a double-all-in and even wait for 500 confirmations (about 2 hours). This might come along with the security warning that is readable everywhere because frontier is still not considered to be stable. I guess that's overkill.
To sum up, it always depends on your application and the attached value to consider which number of confirmations is considered to be secure.
Ethereum theoretically approaches finality in less time than Bitcoin, due to the GHOST protocol. This means that, with a 15 second block time, roughly 40 blocks are needed to match the 60 minutes that 6 Bitcoin blocks takes.
Therefore, assuming no major consensus bugs, 40 confirmations should be more secure than 6 confirmations in bitcoin. In practice, about 20-25 confirmations should be enough for reasonably-sized transactions.
From Vitalik Buterin says in Ethereum blog at 2015/09/14 about the topic of discussing "On Slow and Fast Block Times" https://blog.ethereum.org/2015/09/14/on-slow-and-fast-block-times/
only a small number of extra confirmations (to be precise, around two to five) on the faster chain is required to bridge the gap; hence, the 17-second blockchain will likely require ten confirmations (~three minutes) to achieve a similar degree of security under this probabilistic model to six confirmations (~one hour) on the ten-minute blockchain.
I've seen exchanges use 375 confirmations. But as the difficulty increased and the network got more decentralized, it's safe to go way below this.
Of course it depends on how critical the transaction is. As a rule of thumb, wait at least 5 confirmations for amounts higher than $500. Then, add 5 confirmations for each $1000 the transaction is worth.
It's been several years since this was answered.
New thoughts on "how many transaction to wait" have been written. Here's an article that sums up these thoughts.
TL;DR - the Ou rule states that recipients should wait until the transaction’s value and ledger costliness match to consider a transaction settled.