Because of the unique access that PayPal has to virtually unlimited funds from its users and the length of time it takes to return funds if there is fraud I strongly suggest allowing users to opt-in to a dual authorization system for transactions. Another large online company uses an authorization code sent as text in addition to requiring user name and password. While I appreciate PayPal's anti-fraud efforts it seems that in the present day and age, user name and password just aren't enough anymore. A dual authorization system could save everyone a great deal of time and trouble.
