According to this YouTube Video – as easy as pie.
Watch how the creator takes you through creating a Facebook Log In page and how by changing one line of the Facebook Source code and uploading two files – an index.html and one PHP file – to a free hosting service the phishers are able to gain access to the log in details of unwary people thinking that they are signing into Facebook.
Scary stuff.