My experience with PayPal is they do go to lengths to verify people. I had to give my address and respond to a mailing to that address before I had full use of their services.

If Allan's credit card number was available to a thief due to neglect by PayPal, that would be a very serious problem. I haven't heard anything telling how the thief got the credit card info. If I know your name and credit card number, I can buy stuff all over the place, from numerous merchants. Why do you blame PayPal?

The real problem is the credit card companies' attitudes towards this sort of theft. They seem to consider it a cost of doing business, and then pass the cost on to the consumers. A few years ago, charges started appearing on my credit card, from California. Somebody was buying gas and groceries all over LA. Visa changed the card number for me, had me sign an affidavit that I didn't make the charges, and credited my card. They didn't pursue the thief, on the theory that it was a waste of time.