I once fell for the worst trick on Runescape (bare in mind, I has 7 or 8), someone said "Jagex doesn't let you type your password, try it", cue me, the idiotic child (who has managed to get his hands on a decent amount of loot) typing in my password, then realizing my mistake right after I press enter.
So did I do the sensible thing of making a PIN number on my bank account, and just putting everything in there? No. I logged off immediately, thinking I could change my password before they could. I was wrong.