[hrasyid]

Don't browsers typically verify the identity of a HTTPS page and warn you if something is not right?

[sp332]

Right, but in this case your browser never sees the page over HTTPS. The attacker makes the secure connection, and feeds you data over an insecure connection that they can see.

  You <-(HTTP)-> Attacker <-(HTTPS)-> Facbook