With paypal, finding out what is a 'real payment' is actually pretty hard - they do these odd 'echeque' payments which are reversible for a number of days. they also do 'buying a product' payments which can be reversed through a buyer-usually-wins process, and 'friends and family' payments which are mostly-but-not-entirely irreversible.

They all come with differently styled legit emails, which blend right in to the fake spam emails also claiming to be from paypal.

I can totally imagine confusion occurring.