You can't blame Paypal for the fact people fake messages from them as Phishing attempts. People do the same from banks, the IRS, whatever -- PayPal's an "effective" fake-source because a lot of people have (or had) Paypal account. Those "Please update your information" messages don't happen...