German law basically dictates that if you tell someone they won a prize, you have to give them that prize, no ifs or buts:<p>§ 661a Gewinnzusagen
Ein Unternehmer, der Gewinnzusagen oder vergleichbare Mitteilungen an Verbraucher sendet und durch die Gestaltung dieser Zusendungen den Eindruck erweckt, dass der Verbraucher einen Preis gewonnen hat, hat dem Verbraucher diesen Preis zu leisten.
Another German legal blogger chimes in on the gaffe: <a href="http://translate.google.com/translate?sl=de&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.lawblog.de%2Findex.php%2Farchives%2F2013%2F06%2F07%2F500-euro-von-paypal-schn-wrs%2F" rel="nofollow">http://translate.google.com/translate?sl=de&tl=en&js=n&prev=...</a>
TNW broke the story in English <a href="http://thenextweb.com/insider/2013/06/07/paypal-accidentally-sends-out-emails-telling-users-theyve-won-500-but-they-havent/?fromcat=all" rel="nofollow">http://thenextweb.com/insider/2013/06/07/paypal-accidentally...</a>
TL;DR PayPal Germany seems to have sent mass-emails claiming German customers have won 500,- EUR when they have in fact not. Kaspersky Labs have verified emails as legit, coming from PayPal.