Fwiw my PayPal account uses two-factor authorisation, i.e. it sends a code to my mobile number after I've signed in, which I also have to enter to confirm a transaction. It's definitely a lot more secure, but in truth I don't know if it's used to set up regular payments as well as one-off purchases. If you can use it for things, I'd recommend it strongly.
It's an ugly world out there in terms of online fraud, easy pickings for criminals because of the scale you can operate at and the fact that it's difficult to make an arrest.
On the back of this I think I'll go away and do some double-checking myself!