It's still a fake domain name. Don't trust random websites the same as how you use the web in general. Also, asking for a bank's OTP code is a gigantic no-no, but I don't suppose they really need that to collect the money?