Couldn't the hacker just pass on the username that I assume is being used to select the photo on the real site, and then put that image in place on their fake l

Couldn't the hacker just pass on the username that I assume is being used to select the photo on the real site, and then put that image in place on their fake login site?