The phisher site doesn't need to hack the bank's site. Just by way of example...
Suppose the phisher sets up a site at https://www.bankamerica.com. (Notice that the real site is at bankofamerica.) Somehow, they entice you to go there. Or more interestingly, they subvert DNS so that the correct url resolves to the phisher's site instead of the bank's.
This is not a theoretical attack. This is exactly what the Windows W32/Zlob malware, and its Mac cousin, OSX.DNSchanger, does.
