I'm afraid i have to agree with all the people
here. You are to blame.

Also, you say, "It is my right to be able to trust
whatever I do in a password-protected area" but
you should be aware that those scammers cannot use
a secure transaction server. You should have
realized about it when you were filling that form.
Even if the e-mail of the scammer includes a link
that seems to be starting with https:// you should
notice that when filling the it's a plain http://
form.

What to do? I believe you already know what to do,
if you cannot take control of the situation asap
then cancel your credit card and get a new one,
and go talk with your bank so they can put a
blockade on your accounts registered with paypal
so no transactions can be made unless you go in
person.