They're looking for that split second knee jerk reaction with stuff like:

Please confirm this e-mail address that was recently added to your paypal account.
Or
We've just had to close your paypal account for (pick a reason - my favorite:  $6500 exceeds your monthly processing limit, LOL).
Or
Your paypal account has been suspended/shut down because of an unworking e-mail (when you GET the e-mail at the only address in your paypal account)

There are several others, of course, but again they're looking for that sudden moment of just reacting.  Anecdotally, I have had quite a few with *.edu" in the alleged paypal address they want you click on and, even curiouser, most of them have really horrible misspellings and typos.

Best advice as above:  TYPE IN THE PAYPAL (OR EBAY OR WHATEVER) IN YOUR BROWSER.