You are absolutely correct. No one should be providing their PIN anywhere other than the withdrawal page of SR. You will NEVER be asked for your PIN!