That doesn't sound right, you are asked to change your PIN when you make a deposit for the first time but certainly not your pass phrase. As the poster above suggested can you please confirm the URL you used to access SR, you may have been phished.