No offense but everyone who gets phished is adamant it couldn't have possibly happened to them. You seem to know what you are doing based upon your post, I cannot comment on what may or may not have happened in your instance, all I know is your funds cannot be withdrawn without the use of your PIN so your credentials must have been compromised, somehow.