Anyone using ebay's paypal to transfer payments really needs to read this. "A cross-site scripting flaw in the PayPal Web site allows a new phishing attack to masquerade as a genuine PayPal log-in page with a valid security certificate, according to security researchers."