Sounds phishy to me. Any email that prompts you to click an included link and then log-on is considered a no-no. This being done now, however, at least you haven't compounded the matter by giving them your password through their log-in. If you're worried about your Paypal account, log in...