John - I don't have any paypal app on my phone, so it cannot have come from there. I too am only just out of the tin can era. My password is at least 8 chars alphanumeric.

What is scary is that it was linked up to a credit card (not any more!) and more could probably have been taken. They just cleared out the visible balance - - therefore managed to see it somehow.