Take a look at the selling/buying vindictus forum.
1) Usually cards. You buy the cards that have the codes on them and give them the code.
2) I have no idea. I think its just more of a risk of getting scammed
3) Either person will go first, but if you have no vouches, its kind of hard to find someone who will go first.
Best use a MiddleMan (MM). Essentially someone who is trusted by both buyer and seller. I believe you and buying deals with the MM and the MM deals with the exchange. I would imagine that for the nexon code, it would be best if the MM could view the buyer's screen so that he/she confirms that the code was inputted correctly and worked.
Other veterans will probably tell you in more detail. There's always a risk haha.