The e-mail from PayPal said I’d sent $400 to a gaming firm in Germany. It’s a dopey phishing expedition, I thought, and authentic-looking, for sure, but nothing to worry about.
The trouble was that when I logged on to PayPal, I really did have a $400 withdrawal. It was clear that someone had my password.