It sounded sketchy from the moment they asked for a pin code that they sent to your phone. It's easier to talk from the outside, but that should always be a red flag. What exactly would they be confirming by sending a PIN to the same number they were already contacting?

But that's a great heads up. Phishing is not just about obviously fake e-mails to hotmail accounts.