Also a good move for PayPal is to have the Security key. It is like 5.00 but it has a number set locked to the key and it generates a number to put after your password each time. So even if they now the password they can not do anything.
https://www.paypal.com/cgi-bin/websc...ityKey-outside