I've even had one which linked to a site which would fool a casual and hasty observer, although it is still quite bogus. However, these cretins forget the cardinal rule from PayPal which I quote below (it's hanging on my wall lest I forget):
PayPal will only address you by your first and last name, or by the business name associated with the account.
As a corollary, any message starting with 'Dear PayPal member' or 'Dear PayPal user' or any other friendly greeting is BOGUS and should be considered a phishing attempt. You can enhance your protection by adding an extra letter to your surname, so that the account is in the name of, for example, 'Wayne X.' Hunt. That prevents a particularly clever scumbag from combining publically email addresses with a forged PayPal header, as the X. in my example would not be publically known.
