One person at the agency finally suggested I back my story up with a police case number. I spoke to a St. Louis police detective who was helpful but not surprised by my story. The phrase identity theft was not part of the popular vernacular, but he predicted that this sort of crime would be a big deal within 10 years. When I called the collection agency back with my case number they promptly and politely informed me that I was off the hook.
I get fake email from PayPal all the time, and I dutifully forward it to email@example.com. They then send me back a note confirming that I received a fraudulent message, and reminded me of how to discern a genuine PayPal communique from a phony one. That's how I knew there was real trouble earlier today when the PayPal message confirming my payment to a stranger of several hundred dollars greeted me by name.
Somehow this person got into my PayPal account and sent themselves a large payment. I filed an online unauthorized transaction report with PayPal, and also called them. They told me they would investigate and that whoever did this probably did not get my whole credit card number, just the last four digits. I also called my credit card company, and they were extremely nice. They said to let PayPal handle it for now ("it is their job"), and if the payment actually "hit" my card then they would take care of it for me.
A couple hours later PayPal wrote to say the situation was resolved and the "seller" was issuing me a refund. The email also contained this transmission from the thief:
The email address of the person who tried stealing my money is: firstname.lastname@example.org.Message From Seller:
If anyone knows of any clever, mean-spirited (but legal) retribution I'd be honored if you carried it out on my behalf.