You handed over everything.
In a real attack, the moment you clicked Submit, the attacker would have captured:
- Your account number — used to identify and target your account
- Your net banking password — immediate access to your funds
- The OTP — the only second layer of defence, now gone
The padlock and "sbi-secure-verify.in" look official. Neither is. The padlock only means the connection is encrypted — it says nothing about whether the site is legitimate.