He provided his PIN and password to a phishing site because he thought the message was legitimate.