At my company, there was a specially-trained fraud department that could handle cases like that, with specially arranged hoop-jumping to prevent social engineering for information. I would expect that Paypal has something similar, but maybe the phone drone in that case was too untrained or unmotivated to transfer things to them.