How do phishers do this?

[C.R.E.A.M.]

I just received the following e-mail:
[ QUOTE ]
You have added [email protected] as a new email
address for your Chase Manhattan Web account.



If you did not authorize this change or if you need assistance with your
account, please contact Chase Manhattan customer service at:






https://chaseonline.chase.com/chaseo...so_co_home.jsp



Thank you for using Chase!

The Chase Manhattan Bank Team



Please do not reply to this e-mail. Mail sent to this address cannot be
answered. For assistance, log in to your Chase Manhattan account and choose the "Help"
link in the header of any page.


[/ QUOTE ]

I know this is phishing and I wasn't dumb enough to click it. So then I did "right-click"->"properties" on the link, expecting to see some stupid URL, but it actually directs you to the page "https://chaseonline.chase.com/chaseonline/home/sso_co_home.jsp". Can someone explain to me how the phisher has what looks like a secure web site at a chase.com URL? Just looking at the URL, how would one know it's BS? I'm kind of ignorant on stuff like this.