Is it possible? Yes. This article from 2015 describes one way:
[T]he fraudsters were able to perform a man-in-the-middle attack by programming a second hobbyist chip called a FUN card to accept any PIN entry, and soldering that chip onto the card’s original chip. This increased the thickness of the chip from 0.4mm to 0.7mm, "making insertion into a PoS somewhat uneasy but perfectly feasible,” the researchers write.
The researchers explain that a typical EMV transaction involves three steps: card authentication, cardholder verification, and then transaction authorization. During a transaction using one of the altered cards, the original chip was allowed to respond with the card authentication as normal. Then, during card holder authentication, the POS system would ask for a user’s PIN, the thief would respond with any PIN, and the FUN card would step in and send the POS the code indicating that it was ok to proceed with the transaction because the PIN checked out. During the final transaction authentication phase, the FUN card would relay the transaction data between the POS and the original chip, sending the issuing bank an authorization request cryptogram which the card issuer uses to tell the POS system whether to accept the transaction or not.
Effectively, there are two things that a card reader can do with your PIN when "you" enter it - it can encrypt it and send it to your bank to verify, or it can give it to the chip (either in an encrypted or unencrypted form, but it doesn't matter here) and ask the chip whether it's correct. By intercepting that request and replying "correct" no matter what, the reader thinks that everything is good, even if the PIN was wrong.
Since then, the methods of tricking chip-and-pin have just gotten more sophisticated.
The bank should be able to tell you whether the PIN was "verified online" (sent to them) or "verified offline" (validated by the card). If it was online PIN, then I really have no idea how it could have happened.
I know you don't have the receipts from these transactions, but the next time you do use your PIN, look at the receipt for something called
Tag 95 or something along those lines. It should be a ten-character string. If the 6th character is a
4, then the PIN was sent to your bank. (See here for the rest of it, or here for a decoder).