> I don't understand why I would never enter a code into the wrong website

That's what phishing is predicated on, and it seems to be successful enough.