This is the page which is presented to the user.
Now he only has to be lured to click on the link to trigger the action on the target page.
A little bit social engineering is enough...
... as seen here - You would click now, or not?
Please klick here!The same with visible iframe.