If the victim fails to realize the leak in time, the attacker can log into their account. Once they click the link and enter their Facebook username and password, the attacker grabs that information.
For instance, they can send a message telling the victim to log into their Facebook account via the given link for security purposes or to retrieve a message. Phishing happens when an attacker sends a fake link to a victim.
Social engineering often accompanies this type of attack. If you leave your phone number or email address public on your Facebook profile, then you're more vulnerable to phishing attacks.
