Yes, almost exactly the same thing happened to me, except my bank account was being drained, too, as I had PayPal backup funding. It takes about a week to get everything back in order. Longer, maybe, for your bank to get everything back if it was pulled, too.
It's not really PayPal's fault; they have to follow the rules of both MasterCard, and of Chase, the bank that issues the card. They can't even accept the dispute until the money clears. That's a MasterCard limitation. Why? Because fraudulent amounts may never clear.
Here's what happened to me: I noticed a $1.00 charge from NFB (National Federation for the Blind), which I didn't think about because I'm one of their vendors. I should have noticed, but I didn't. The next day I had an amount taken that exceeded my PayPal balance and went into my backup funding. I noticed that. It was a company (similar to PayPal in Russia. Their website was in Russian. Their whois information had a phone number. I called the number (in Russia) and got a Russian language voicemail. I left a message in English, telling them that someone had used my card fraudulently on their site. Someone who spoke English called me back as soon as they opened (the middle of the night our time) and I told her what happened. She checked, noticed that the information she got didn't match my address, etc., and immediately cancelled the charge. It took about a week for everything to settle out. (See my previous post today to someone about how holds vs actual charges works and why it takes time.)
Of course I notified PayPal and reported the card as stolen; it took over a week to get a new one. And I closed the backup bank account because either I pancicked or because you can't be too careful. So for a week I was fiscally challenged.
It's just the way things go in the world of business. Get used to it.
Jeff
