Many hackers have similar websites to facebook. They continuously send emails to people asking to log in to their account to check new photos of their friends, or similar message. When the user opens the website, it looks 100% facebook, then he enters his user id and password, hot knowing that his account details is being stolen by a hacker