Product: Money transfer, virtual currency, or money service

I am writing to inform about PayPals unprincipled business practices. On XX/XX/2019 I sold a {$400.00} gift card for the amount of {$380.00} on XXXX. I received an email from both XXXX and PayPal, informing me about the sale. The buyer subsequently wrote asking for the gift card in order to use online. At this time, I confirmed that the username messaging me through the XXXX messaging system matched the user name listed on the PayPal transaction and email. ( Please see attachment labeled username ). As you can see, the username I wrote to on XXXX, matches the username PayPal gave me. At this time the person via XXXX confirmed receipt ; they left positive feedback confirming that they spent the gift card ( please see attachment labeled positive eXXXX feedback ). As you can see there is no question that the username PayPal provided me used the gift card. On XX/XX/2019 I received an email from PayPal stating that the transaction for my gift card was unauthorized, siting that there was suspicious activity on the buyers PayPal account. PayPal then took the money out of my account leaving me with a negative balance of {$380.00}. Outraged, I called PayPal asking what they problem was. They told me that the buyer did not authorize the charge and because it was a nontangible good, ( since I messaged the person the gift card number via XXXX secure messaging system ) I am not protected under seller protection, and I am therefore responsible for the unauthorized transaction. How am I, the XXXX seller responsible for PayPals poor security? I am not asking to be protected under seller protection, I am asking PayPal to be held responsible for their security mistake. This does not make any sense that I would be held responsible for a mistake made my PayPal. It is PayPals responsibility to ensure accounts are secured, and if they dont, they need to be held responsible for their mistakes. The innocent XXXX seller should not have to eat the money, as I have nothing to do with their security practices, or in this case, lack thereof. When I was on the phone with the PayPal representative, I asked her what suspicious activity they found. She told me that the purchase was either made in a different state other than the account holders address, or an unrecognized device was used ( XXXX instead of XXXX or vice a versa ). This brings me to personal stories exemplifying PayPals poor security. I recently made a trip to XXXX XXXX XXXX ( I live in Maryland ). I attempted to purchase a subway card for just {$10.00} using my XXXX XXXX debit card. My card was declined, and minutes later ( unlike PayPal ) I received a call from XXXX XXXX asking if this was an authorized transaction. If this purchase was occurring in a different state, why was the buyers transaction ( for much more money ) declined until they could either say yes, the charge was from them, or no the charge was not authorized. It is PayPals responsibility to flag suspicious purchases ( quickly, not take weeks, especially ones as large as mine ) and require customers to secure their accounts. Second, I have a credit card with XXXX. I always login to XXXX via my XXXX. I marked my XXXX  as an authorized device. Occasionally I will use my desktop to login. Because my desktop is not an authorized device, XXXX sends me a text message to the phone number I have on file, with a security code to allow me to login on the unrecognized device. I wanted to test to see what would happened if my brother, who lives in a different state than I do, logged into my PayPal using his XXXX phone. I gave him my username and password and asked him to log in and try to make a purchase. He had no problem not only logging in, but also was able to make a purchase from another state. As you can see PayPal has terrible security, and fails to protect customers account. I should not, under any circumstances, be held responsible for someone cracking into this users PayPal account. It is PayPals liability to ensure that transactions are being made by the account holder, and if they do not, as in my case, they should be out the money, not the seller who has no ability to improve PayPals security.