he never has paypal account. someone must have known his credit card details, then went to paypal to register his card details and start to buy stuff online. The bank is maybank. the staff at maybank said they cant trace who's the person who did it.

Issit true you can't trace the person? I know this is not like hacking where u can trace by IP address, etc...then how ahh?