SMS 2FA is better than nothing, but SIM-swapping attacks can bypass it. Use an authenticator app (Google Authenticator, Authy) or a hardware key (YubiKey). Go to Settings → Security → 2-step verification to set this up.
Knowing where to click is half the battle. PayPal has redesigned its interface several times, but the log access remains robust. paypal logs