Today morning I read about John receiving spoofed email, which tried to induce him to click on faked Paypal login screen. I wanted to tell him that easy way to verify whether email is from Paypal or not is to check the greeting. If you see ‘Dear Paypal Member’ as greeting, it’s fake. If you see ‘Dear [firstname] [lastname]‘, then it’s genuine.
Surprisingly, I received a very similar mail to my GMail id this afternoon. [Btw, I don't have Paypal account associated with my GMail id.] It’s interesting how GMail handled this mail.
It displayed a warning in red to indicate that email is fake. See below:

If that warning was not enough, GMail removed the link (which was pointing to http://64.119.183.112/billing/verification/paypal/ )from the mail. See the highlighted part at bottom in above screentshot, it should be actually a clickable link.
I think that’s a great idea! Most of the time, phishers display a legimate URL as text and link it to their own site. By taking this step, GMail insured that even if a user ignores the big red warning and copies the link from email, he/she would land to genuine Paypal screen!
This made me curious about how GMail figured out that mail is spoofed. So I went and looked into headers.
X-Gmail-Received: 25ba27ed91116c063538f4ca126d8d9871861f1e
Delivered-To:
Received: by 10.36.58.15 with SMTP id g15cs21285nza;
Wed, 6 Apr 2005 13:24:08 -0700 (PDT)
Received: by 10.54.76.3 with SMTP id y3mr425845wra;
Wed, 06 Apr 2005 13:24:08 -0700 (PDT)
Return-Path:
Received: from ns3.worldcall.net.pk (ns3.worldcall.net.pk [203.81.192.10])
by mx.gmail.com with ESMTP id 27si350983wrl.2005.04.06.13.24.06;
Wed, 06 Apr 2005 13:24:08 -0700 (PDT)
Received-SPF: softfail (gmail.com: domain of transitioning service@paypal.com does not designate 203.81.192.10 as permitted sender)
Received: from killer (host172-202.worldcall.net.pk [203.81.202.172] (may be forged))
by ns3.worldcall.net.pk (8.12.5+Sun/8.12.5) with ESMTP id j33NqR98002882;
Mon, 4 Apr 2005 05:52:40 +0600 (PKST)
Message-Id: <200504032352.j33NqR98002882@ns3.worldcall.net.pk>
Do you see that Received-SPF header? It’s a new header which can help fight email spoofing.
How it works? pobox.com explains how SPF works.. In short,
1. Domain XYZ.com publishes list of IPs from which it sends out emails.
2. Whenever your email server receives mail domain XYZ.com, it checks the list of IPs for XYZ.com domain, and IP, from where you received mail, doesn’t belong to that list, your email server can mark email with appropriate SPF Header to indicate that email is not from XYZ.com domain. Short and sweet!
GMail interface checks for this SPF header and displays the red warning box, as required. It also removes all the hyperlinks from such mail. I wonder why Outlook (and other Email clients) doesn’t do the same. So John, other than making sure to be fully awake, you can use GMail as your email client! 
JD