If you want to be extra sure, change your password again once you have verified you're actually on the real PayPal site.

A really good phishing attack will relay the input credentials in the background to the real site and be able to present you the various account bits you'd expect to find there.

IMO, PayPal should not ask for the full credit card number for verification. It should ask only for specific digits from the card or your bank account. It doesn't need the whole thing for verification purposes. Besides, if someone had access to your PayPal account because they had gained access to your computer or your home, they'd also likely have the full account number, wouldn't they? Say from bank statements for example.