I would call PayPal, although when I did a few months ago I discovered they don't have 24 hour 7 day a week customer support. Someone had broken into my account on a Friday after PayPal telephone support closed (probably timed the fraud to make sure it would take days for me to contact PayPal) and charged $30 for a farming game (I assume as a test of the password), and then someone transferred $1000 from my account to some other user (a random bunch of letters at gmail.com if I remember correctly.) Of course both amounts were immediately debited from my and my wife's joint checking account. (I probably would have overdraft had I not discovered the fraud within minutes of it occurring via an email receipt.)
Right away I called my bank and disputed the charge and did a stop payment (which cost me $30, if I remember correctly) When PayPal opened on Monday, I was able to get them to conduct an investigation, they reversed the charge a couple of days later.
I was not happy that PayPal can take money out instantly, but not even have staff to take a fraud report on the weekend. I also wonder if they would have refused to reverse the charge had I not already involved my bank? I don't know.
Anyway, since PayPal simply was not available to reverse charges 24/7, and is linked to my only checking account, I chose to close the PayPal account for good. In my opinion having PayPal linked to a primary bank account is way to risky, unless they provide fraud support 24/7.