"tim g..." has an excellent idea; have a dedicated Internet related bank account with limited funds, so you don't get totally wiped out by some fraudster.
Official Pay-Pal site would NOT ask for your bank account password.
Account # maybe...
Perhaps they want you to 'create' a Pay-Pal password?
(see "The Last Watchdog" for more: http://lastwatchdog.com/banking-trojans-infest-internet/
The Pay-Pal site has been spoofed (mimicked) a lot for stealing account info, so make certain it's the Genuine one.
It should be over "https" connection.
Click the browsers "lock", then examine the pedigree of the certificate, and compare the sites certificate (if it has one) to those in the CA file as outlined below.
Any strange authority could mean some monkey business going on.
Authentic, trusted "root" certificates can be found in the browser:
Firefox> options> Advanced> Encryption tab> View certificates> Authorities tab. Here, look for the signing root certificate. IE would be similar maybe, but I never use IE for monetary transactions.
Of special note: if you allow "active scripting" (a typical Internet Explorer configuration), and the site you're on has been hacked, then it's very possible to have a "cross site scripting" where your session authentication cookies are being redirected to a 3rd party, where they can mimic your machine; log in as you, and cause major problems.
SSL does NOT protect against this.