[masraum]

I'm just thinking outloud here.

I think what you think (phishing scam) is right on. They wouldn't send you an email if they had their hooks in deep. They are trying to get the good info.

So, assuming the payment amount and any other specific details of the email are accurate, I'd assume that they have either 1) seen some of the details of the sale, maybe from the merchant's side or paypal (less likely to me) or 2) they have seen your email with confirmation (which I also think is less likely unless they have your email account user/pass info.

My guess is that they've got a small hook in at the vendor end that allows them to see superficial info about sales.