I get these kinds of messages in my email, it's always good to immediately check the sender, they often will have a different address than their display name. Also, the body text of these messages will usually also give away the game, apart from the greeting, as the other poster has noted, you might spy some odd constructions, let's just have a look through this together:
"Dear Client,
Suspicious Activity on Your Account
Your Account information has been changed. [ Billing or Shipping Address ] As our security precautions, we need more informations from you."
I've cut off the rest of the message, but, let's just really walk through all the red flags in that second sentence. It really just is a greatest hits of phishing scams I've seen. The way that bracketed statement just sort hangs in the air awkwardly is something you don't see in pretty much anything. The rest of that sentence is just very strange English you won't find in any professional communication from a company the size of Paypal to their users. The most obvious give-away will always be the link they end these kinds of messages with. It is unusual in the first place for any business to direct you immediately to a login page from a template message, if you can determine the url is suspicious before clicking on anything, you should also take note of where the link can display it leads to, which, much like the sender's address, even though they do the work to obscure the location in the body text, they generally don't spoof the actual address.
You had exactly the right instinct to circumvent the message entirely and login to your account in a separate page.
