Paypal use a protocol called DMARC, what that means is that if your mailbox supports said protocol (Microsoft, AOL, Yahoo! and Gmail all do) then you can't receive a Phishing email from the whatever@paypal.com domain.
So - if your mailbox is with one of the big four, check the sending domain, if it's from paypal.com then it's been sent from their infrastructure - note that it could still be fraud, as per this article (http://www.theinquirer.net/inquirer/news/2466291/hackers-spreading-chthonic-zeus-malware-via-legitimate-paypal-emails?utm_content=buffer0c35b&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer).
Note - DMARC doesn't protect the display name, so it's now common place for attackers to send an email that has something like this in the 5322.From field:
Paypal Security <paypal@security.com>
Or a variation would be:
Security@paypal.com <paypal@security.com>
In both cases the actual sending domain is in the brackets, note it's nothing to do with Paypal. The second example is interesting from a "how the brain works" perspective as you will rearrange the second address to match the first, as that's what you are expecting to see.