Phishing sites come in all forms and could very well use HTTPS. They leverage the authority and trust that https:// and its padlock bring to lull people into a false sense of security. They think the website is safe and legit, while in fact, it’s just a phishing site trying to steal their information. While an HTTPS certificate ensures that no one else can see what you’re doing while you’re on the site, your details can still be stolen by the site itself, if it’s malicious.