I just spoken to paypal after a 2 hour call queue.
It took me 15 minutes to explain it is not the normal paypal account but the card, and he then proceeded to tell me its a different team. O_o, he was trying to tell me to change my password and all will be solved, when the debit card doesnt need someone to login to paypal.
I then rang the number on the back of the card as he instructed, and there is an automated message due to coronavirus there is no call operators and it hung up. O_o
So I have now ended up reporting the card stolen on the main paypal UI (should have done this last night), now to wait 10 days for another card, but still the problem of having to reclaim the £35, the call operator did tell me the attempted transaction was for £4995, I was lucky, my bank account wasnt linked as that probably would have worked if it was.
Also thanks tubaman for the link, I did try that last night, and the page no longer offers a 24/7 option, it describes how to dispute from inside the account page, when I try to dispute it says "We’re sorry, you can’t file a case on this type of transaction. Please refer to our User Agreement for more details.".
Just changed my payment card to a credit card for my xbox series S pre order on amazon and will also need to edit for all my upcoming food deliveries as well now
but guess i am lucky I have only lost £35.
d2d4j, I dont think the account has been hacked, it has a very strong auto generated password, and 2fa is enabled. The transactions were both debit card transactions which do not require paypal authentication, essentially you just need the 16 digits, expiry date and 3 digits from back, they work just like other debit cards. However I did change my password as a precaution. The paypal business debit card is a full debit card. Information here
https://www.paypal.com/uk/webapps/mpp/business-debit-card7lm, yeah companies are storing them, not all, but at least some are.