They got me too.
It is my citibank debit card. the card itself is not on file with paypal, however, the checking account that the card is link too is the bank account on file with paypal.
I noticed when the first 3 charges showed up. Since the tried to make 10 charges in total. They also tried to buy songs from iTunes.
Citibank refunded the money (while they were just debit authorizations) ...then 2 days later they let the purchases go through

THEN also charged me the foreign fees. I canceled the card.
The theives still were able to get the money.
I then blocked the checking account.
Victim's location
(Bronx, New York)
- Name of bank/type of card used
(Citibank debit master card linked to check acct (which is linked to paypal.)
- # and amount of each charge
(79.99 + 2.40 foreign fee = 82.39)
- Date of each fraudulent charge
(8/20/2007, 8/21/2007 )
- Name of company spelled exactly that the charge was made to
(STC SAWA RECHARGE RIYADH and iTunes)
- If any online shopping is done and what companies used if you can remember
(I made a purchases to GoDaddy via paypal, shirtsupplier.com via their secure checkout, imprintableswearhouse.com over the phone, blankshirts.com over the phone standardscreen.com via paypal)
- Any past history of ID theft (just yes or no)
(no)
I am super vigilant when it comes to my vital banking and credit card info. I'm not sure how this happened to me. I always keep an eye on things