When the phish site opens up, it looks almost exactly like the legitimate login page. However, a few important clues can be noticed:

• The suspicious URL in the address bar - it is not hidden with any tech tricks;
• The HTML errors in rendering the page - something unlikely in an official bank's login screen;
• The absence of a 'lock' icon in the status bar, indicating a secure, HTTPS session (despite the Verisign logo displayed):

Any combination of letters and numbers will be accepted as a username or password - the site has no way to check them.

After the so called 'login', the main phish page (the one asking for the CC and bank account information) opens up:

The same clues, spotted on the first page can be seen here.

The site would not attempt to verify the data entered in any manner - it will accept anything, as soon as the fields are not empty.

After that, the browser is redirected to the legitimate site's privacy policy page: