We are using CiviCRM 4.7.22/Drupal 7.56 and are increasingly encountering a scenario where Civi contacts are sharing their log in details with admin/PA staff to make payment via PayPal with a credit card on their behalf. The problem we encounter is when the admin/PA checkout with Paypal they enter their own name, email address and billing info, not the Civi contact. When the contribution is made this then overwrites the Civi contact. This is particularly problematic for events as we use Civi data to make badges and email joining instructions.
Is this the designed behavior or is there a setting either in Civi or Paypal I'm missing?