The point of the fake PayPal, eBay, Amazon, Hotmail, [insert name of bank] etc. - as explained to me by a techie friend - emails is this. You click on the link to sign in, which looks legit. It usually even has the name of the company in there. Sometimes they try and frighten you by saying there's suspicious activity on your account and they are asking you to sign in to confirm your details. I've had emails of this sort from companies I have no account with, which is a bit of a giveaway. When you click it redirects you to the fake website, set up just to get the details of people like you. Once you sign in here they instantly have at their disposal anything you care to fill in - user name, password, telephone number, address, credit card details. You know what happens next.