So let me answer this in two ways: by the addressing the part of the situation that your attention is on (understandably; it's an amusing/interesting little scenario) and then addressing part of the situation where you're/our attention probably should be.
What do I mean by that? Well, what I mean by that is that there are not one but at least two questions here for someone to explore:
1. Why did that hacker do what he or she did with your mom's Facebook account, that (almost certainly stolen) PayPal account, and the playmoney poker game?
2. How did the hacker get your mom's password to begin with?
On the first question, I have to agree with what others have well-said in their answers: there's a good chance it's somebody testing out PayPal accounts to see if they will work or not. Other than that, let me offer a total guess that perhaps someone simply wanted more chips to play with on Zigna poker on Facebook. That sounds like it's almost too absurd a possible motive to lead anybody to break what is almost certainly a plethora of anti-hacking and anti-financial-fraud laws in place across multiple countries. But, well, cyber criminals tend to be like traditional criminals: a few of them are reliably skillful, disciplined, and careful, but many more are often sloppy, impulsive, and overconfident (Of course, a devil's advocate might argue the same is true about a significant minority of security professionals. But that gets us off down a different track.) I find it totally plausible that this could be a case where a brash attacker like that simply came accross your mother's Facebook login credentials, someone else's PayPal account credentials, and decided they wanted some more chips in Zigna poker.
So, in short, the person either wanted to test the activity of a stolen PayPal account, or wanted to get more chips to play with in the poker app without paying $40.
But now we move on to the much more immediately important issue. There are basically three easy ways a bad guy gets someone's password for a prominent web service:
-- He/she finds a set of credentials that have already been exposed by the compromise and dump of another site's password database on the Darknet and tries the same set across many popular internet services. If the user reused the user id and password anywhere else... well, that's why the first rule of choosing a decent password is making it a unique password.
-- He/she got the password from a phishing scam, where the user thinks they are entering their login info into what looks like the actual Facebook login page but is really a very convincing copy at a slightly different URL.
-- He/she manages to get malware installed on a victim's PC that records the victim's password--and quite possibly every password the victim types in--and sends them back to the bad guy.
( On the issue of password database compromises, an attacker can either (a) have simply found a resource on the Darknet where account credentials are sometimes publically released for all the world to see-- and to have stumbled upon some of those known compromised accounts that still happened to work, or (b) more likely the attacker came across the info for those accounts in lists of credentials that he'd or she'd already purchased access to for other, more nefarious purposes. As I intimated above, doing either of those things would be poor op sec/tradecraft on an attacker's part, in my opinion. But a great many hackers make such errors frequently without ever being held to account for them.)
Now, if your mom's password got grabbed by either of those first two methods she would be wise to read some pointers on the selection & management of strong, unique passwords, bone up a little on the basics of what phishing is, and enable two-factor authentication for all the accounts she can. Your basic user security knowledge touch-up that +95 percent of general computer users can benefit from.
If, on the other hand, one of your mom's PCs, her smartphone, or some other device is infected with password-stealing malware, well.......
And since you don't know how the attacker got your mom's password, the prudent, "responsible" thing to do is, of course, to assume that one of her computers (at least one) is infected with malware and act based on that assumption. And since your mom, though at least a little tech savvy, still probably doesn't have enough of a tech comfort level to feel okay about nuking her OS installs from orbit, you, OP, could well find yourself playing a long-distance tech support role.
Ah, the joys of being your family's internal anti-malware tech support. Who doesn't look forward to that? :)
