Sorry if this is a bit long, my situation is somewhat complicated.
I used to have dual Croatian and Bosnian citizenship. I went to the US once in 2007 and again in 2017, each time applying for and being granted a tourist visa. Since 2019, I have been a dual German and Croatian citizen, after renouncing my Bosnian citizenship (same year).
I'm about to travel to the US again (well, hopefully) in three days. German citizens can travel to the US without a visa through the VWP, so I applied for an ESTA. I fell for one of those scam sites, and while it wasn't too expensive, I'm worried about them having my passport information. However, if I decide to deactivate my passport and apply for a new one, I won't get it in time for the trip, and definitely not in time for a new ESTA application. The application should be submitted 72 hours before the flight, there are less than 72 hours remaining even now (one of the reasons I fell for the scam was because I was in a rush to submit it in the last minute).
The other option would be to use my still valid Croatian passport. While I did apply for a tourist visa in 2017, and it is valid until 2027, it was in my old Croatian passport. In 2022 I got a new one, and this one does not have the visa. I read online (unsure about the veracity of this) that visa do not expire with the passport they are attached to.
Could I use my old Croatian passport with the visa from 2017 to travel to the US? Is the visa in my old passport tied to my trip in 2017, or can I still use it freely until 2027?
I did, after I realized the scam, immediately apply for an ESTA with the proper site (it was actually just approved while writing this). Will that cause an issue, if I now decide to use my Croatian passport instead, effectively not using the ESTA system at all?
Any other options for me here? Or do I need to risk travelling with the compromised passport?
Edit
Another question. I just read that some sites don't actually "scam", but just charge extra, but still result in you receiving a valid ESTA approval. If that is the case, would it conflict with the ESTA application I submitted myself, afterwards? Is there a consequence to applying twice?