The easiest thing is to never click on a supposed paypal link. If you get something that might be from paypal, log into your account and see.
The Paypal dongle, which gives you a six-digit PIN when you press the button, makes your account more secure. You (or a hacker) can still log in without it, but only after jumping through extra hoops. At a minimum this makes your account more difficult to hack. I keep these with me pretty much all the time: the paypal dongle, a pair of 15 dB Etymotic "musician" earplugs, and a FIPS-encrypted USB stick with a fingerprint scanner. The stick is for keeping a relatively secure copy of files I don't want to lose.
WW
"A man need merely light the filaments of his receiving set and the world's greatest artists will perform for him." Alfred N. Goldsmith, RCA, 1922
