While at work this morning I got two separate emails confirming purchases at TheRealReal that I did not authorize. the first was a pair of relatively cheap sneakers paid using my Paypal credit account with my shipping address (a phishing attempt). Then about 10 mins later a Hermes purchase using my Paypal linked to my checking account with a shipping address across the country from me - California.. (google revealed it was a forwarding company for buyers in Asia). I contacted TheRealReal who cancelled the transactions and told me it was my Paypal Account that was compromised. I filed claims with Paypal who promptly denied my claims. I called them & they informed me that I had set up a Billing Plan with them (LAST YEAR) that allowed them to take from my paypal at any time w/out a 2nd Paypal login (news to me since I only used them once for a one time transaction) therefore NOT unauthorized activity!! They also confirmed that it was NOT my paypal that was compromised.. sure enough went back into TheRealReal & found that someone had added this California address to my account. I immediately unlinked Paypal, removed the other address and began to change all my passwords. I was a victim of ID Theft through Verizon back in January and its clear my information is out there. I'll also second guess using Paypal to purchase anything going forward since they did not protect me and informed me that the money for the hermes purchase WILL be taken from my checking before they can apply the credit TheRealReal issued to me.. a 3-5 day process at best.