I do a lot of daily Pay Pal transactions so my inbox is flooded by subject lines that read 'service@paypal'.
I noticed a new one so opened it up and it was exactly like a Pay Pal receipt complete with links showing that I paid Uber $19. I scrolled down to the bottom and clicked on Resolution Centre. ( I didn't notice it was UK)
That took me to a Pay Pal login screen and I put in my email. As I was typing in my long password something felt odd. I looked up in the corner of the address bar and it said 'not secure'.
I opened a new tab and logged into my PP and there was nothing for Uber.
I can close to being cleaned out and it looked so real.
I think the fact that my email addy wasn't cookied in to the log in is what tipped me off.
So be careful out there.