pstation

It could have easily happened. most people don't check that they're going to https://epassporte.com/ instead of http://epassporte.com/ so it would have been very much possible for someone to setup a fake AP and launch a "man in the middle" attack.