Couple of things are kind of vague here. Paypal is telling you that this was a physical transaction, meaning the card was inserted into a machine by someone. Do you have any idea of where the item was purchased? The rabbit hole you would have to go down is a rather vast one that could involve lawyers. The store they were in may have security cameras and able to access the time and date of the purchase and prove once and for all that the person that made the charge was indeed not you.
Also the statement about the EMV chip being embedded into the card and has to be present for the charge to validate is somewhat misleading. Vendors can bypass the EMV chip and swipe the mag strip instead, thus they bypass the EMV authentication. BUT they state that the EMV authentication did indeed authenticate, meaning the chip was present. Whether this is accurate or not is unknown. They may have just checked the transaction, saw the card had an EMV chip and assumed it authenticated.
If you can locate the store the bogus purchases were made at, check to see if they have security cameras and then ask if they would be willing to check at the time and date the purchases were made to see if there is footage of the perpetrator. You may have to get the law involved if they are not willing which opens up a whole can of worms that you may not be willing to afford or pay for.
I guess it all depends on how far down the rabbit hole you are willing to go.
Possible idea here. Talk to Paypal and see if they would be willing to reinstate the card. Destroy yours. Send them a video of you shredding your card as proof that it is no longer viable. If there is another charge levied on your account after your card is shredded, then it will be apparent that they have found some way to circumnavigate the EMV security. Who knows, they might agree for no other reason than to catch a new exploit early before it hits the mainstream.
