How they work (in detail):
1) It's a fake rs website, you think its real, you enter details (username and password) and they get them since its their website.
2) More advanced ones installs a keylogger or trojan horse in your computer, this is seriously fucking hard. What they do is trace your every movement in your computer/in runescape. This way, they can get your passwords and usernames (usually encrypted, though. They can still decode) in other websites AND bank pin.