And the phishing site doesn't ask for your PIN (unless you register an account), making the account info useless.