If from the beginning users were trained to only login to Paypal if they're on paypal.com. Could be accomplished in this sort of transaction via a new popup window.

Of course, the horse is long out of the barn on this.