Unfortunately, that's the web for you, Jim. Paypal gets hacked just like anyone else. And even if they haven't been hacked "lately", they sell your information despite all the disclaimers. So, nobody's data is safe anywhere, despite what any organization will tell you. Assume your information (credit cards, personal info) will get hacked at some point, if it hasn't already. Automatically treat any request (or worse, demand) for money as a scam. Usually the best approach is to contact the organization that appears to be the claimant and see what they say. When you go to a website, be really sure that you're actually on that website. If in doubt, ask for help or simply block anyone except known vendors. Paypal, again like everyone else, moves their support operations to whichever country / jurisdiction has the lowest wages and lightest worker protections. (I see John Deere fired a bunch of people so they can move production to Mexico - good for the Mexicans but not so much for the people in Moline and Davenport. JD also now position themselves as a "technology" company, in the inevitable move towards subscriptions and computers in everything). My usual approach is to limit the number of sites that I use / have login info for. If I can pay by check, that's my usual approach and I say that as a 30 year veteran of the IT industry. In the old country (NZ), one cannot even pay with cash or check for an increasing number of services - you have to be online or you can't buy.