My aunt is a super sharp lady. She was an IT professional back in the day. She called me in a panic about 2 months ago about this same thing. She had seen a charge of $500 show up in paypal for bitcoin. What it wasn't clear to her at the time was that it had been declined by paypal. Basically someone had got her email, guessed it was the same one she used for paypal, and sent a money request which paypal denied.

So she had received an official email from paypal about the transaction, but it wasn't super clear that it had been denied. She logged into paypal and saw the canceled charge listed in the activity window and it had a comment on it with a phone number. The comment said something to effect of 'if you think this charge was made in error, please call this number'. Still in a panic, she called and wound up talking to the high pressure fraud people that are on the end of everyone one of these schemes.

They got her to a website and had her click a link to download a form that they wanted her to fill out. She was working through it and the 2nd or 3rd line had a question about bank account info. She was already on edge and that pushed her over. She told them she needed to call 'a friend' and put them on hold and called me. I told her to hang up immediately, get on a different computer and change her paypal password. After she'd hung up on them, we talked again and got her computer scanned and found some TeamViewer type app that had been installed so they could watch her screen as she filled out that form.

It was really stressful for her, and could have been much worse. Luckily nothing bad seems to have happened, but could have easily been much worse. The level of sophistication was what was shocking to me. They figured out how to get an official email from paypal to deliver their sketchy phone number. Be careful out there and never call or click something that seems sketchy.