I had my debit card number stolen, somehow, maybe a generator, last year. Luckily I always check my bank statements every night. Anyway, I had stuff sent to me from five different places. The idiot who used it didn't put in his own address. When I saw it on my statement, I went to the bank immediately, and all charges were cancelled. NEw card issued. Luckily, all online purchases thru my bank have the source and phone number listed, so I called all of them. Only one wanted the package back, the others let me keep the stuff! The fool even put HIS email address on the orders, so I turned it over to our local prosecutor. They got him for theft!
I was able to prove to paypal on one thing that I didn't order, got my money refunded.
Another thing on PAypal. Best thing to do with them, if your bank allows it, is open an account just for their (Paypal's) use. Only keep (transfer) enough money in it to cover expected purchases. Also, if your bank will allow/do it, get a debit card for THAT ACCOUNT ONLY, and link that one to your paypal account. These are what my bank had me do. Been accident free, since.