Then you get an official-looking email from PayPal saying funds have been deposited but require some action on your part. So you click on a link in the email and they do something like log the keystrokes for your account log in or worse on your computer. At least that's my guess.