Older browsers were subject to a redirect hack, such that the first part of the URL would say paypal.com but embedding in the POST data was the malignant URL. Examples: URL Redirection Attack With Examples | Paralliverse

A bit OT but still paypal, did you know:

Internal Revenue Code (IRC) Section 6050W states that all US payment processors, including PayPal, are required by the Internal Revenue Service (IRS) to provide information to the IRS about certain customers who receive payments for the sale of goods or services through PayPal. PayPal is required to report gross payments received for sellers who receive over $20,000 in gross payment volume AND over 200 separate payments in a calendar year.

Oh I suppose there's a possibility of that.

I got my come on from "EBay". Log on, provide important information. Blah blah. Don't answr

I have all my email from Ebay sent straight to my spam folder. I never look at it. If they want to get in touch with me it will be the next time I happen to log in which is rare. I often have several messages a day that are supposed to be from them. They might be, but I don't care to find out. Same thing for all PayPal email. Just trash.