Fiddler uses a certificate which you need to trust to intercept traffic. Enterprises also do this type of thing on a larger scale (see products from Bluecoat for e.g.) to monitor employees and for detecting exfiltration of data.

Of course outside of the enterprise phishers will use a variety of other tricks as they are not in control of your CA list you trust (as you mention here) on your device. So they’ll for e.g. use domain names that either look legit or are very close to a real domain.