Never ever not ever click on an email link from Paypal. Always log in at your account. Crooks can make some very convincing emails that look like the real thing.
Even though I am very careful I just had an incident. One of my vendors called to tell me that she charged me the wrong amount so I logged into my account and was shocked to see nearly $2,000 in charges for computer equipment! To make a long story short, someone got hold of my name, account number and telephone number and purchased stuff that was then sent to Ohio to someone who just tacked my last name onto theirs.
I called Paypal and they closed that card and sent a new one. After a couple of weeks they issued me a provisional credit. That means it could be reversed depending on the outcome. I called the police department in the town in question and started an investigation. Only after forwarding my emails to the police did Paypal tell me that the refund was now permanent.
I don't know how crooks get hold of this information, but they do. I am very careful but I still got taken. So be sure to review all of your accounts closely to be certain that nothing is off.