One of my colleagues got a PayPal phishing LETTER, actual USPS mail, this weekend.
Dear valud customir,
We have discovered an attempt by someone elce to use your accountant. Please send us your username and password so we can check it out.
PayPal is refining their site all the time, so I feel safer and safer with each improvement.
Someone must have had a personal knowledge of your colleagues because most correspondence doesn’t come from PayPal. There is nothing on the outside of the envelope that even hints at PP.
And if the email had been real, I would actually have seen the message on my PP account, not in my email account.