PayPal fraud: What merchants should know