This is a well-known scam, you're right. It's best for users to try to memorize the correct URL and to remember - like you mentioned - that the real SR site NEVER requires your PIN at login!