According to PayPal (and eBay for that matter), there is an easy way for you to initially establish the potential legitimacy of such correspondence. If the e-mail is addressed to you personally (i.e. Dear John Smith or Dear David Jones), it probably emanated from PayPal or eBay. If, however, you are addressed by such vague or universal terms as "Dear Valued Member" or "Dear PayPal Member" etc., then it is definitely not legitimate. The advice to send the questionable correspondence to spoof@Paypal.com or spoof@eBay.com is absolutely correct. You will receive an answer in a very short period of time.