Yeah, PayPal, eBay, and all the banks (WAMU, Citi, SunTrust, whatever) get used like this in an effort to discover a real phish at the end of the scumbag's line. Most of the phishers will mock PayPal or eBay because of the sheer popularity of those sites. Real sites will always address you by your own name. Real sites won't ask you to click a link and hand them your ID on a platter. Real sites have their letters checked for grammer before they get sent to valued customers. But, figure this, if even .00002% of the recipients are foolish enough to click a link and type in their financial data, that is still a lot of people who are at risk. Carolly