"...be sure to check the URL. If it’s something like http://74.98.30.203/ebayaccountverify.php IT’S A SCAM!"
How hard would it be to write a virus that changed a victim's browser (say FireFox or Chrome, which are both open source) so "paypal.com" appears in the address window when the real URI is something else? It's a scary question.. just throwing it out there.