... PAYPAL must have been hacked or I would not have been getting all these phishing attacks telling me to update my paypal account. Even ... This is an incorrect assumption. Someone (well, many people) can (and many do) send phishing messages pretending to come from PAYPAL without involving PAYPAL at all. That's pretty much the definition of phishing after all. Of course, the messages don't actually come from PAYPAL. However, given the information available, it can be quite difficult to determine whether a message is legitimate, even for people skilled in the area. Craig