People questioned your story because you claimed never to have logged into a phishing site, to have had a strong password and PIN, and yet to have had someone successfully crack BOTH your password AND your PIN. This is highly unlikely unless your password and PIN were weak, or unless your computer is compromised with a keylogger or something.