Alice wants to login to her account at https://www.bobsbank.com/. However she clicks on a malicious link in an email and instead gets sent to the malicious site https://www.charliesbank.com/. The malicious site has a secure SSL relationship with Alice. Alice sees the "this site is secure" padlock icon in her browser. When the malicious site (Charlie's Bank) receives Alice's request, the malicious site decrypts the request using the SSL certificate which it owns. It then re-encrypts the request with the public key for Bob's Bank. It has established an SSL relationship with Bob's Bank. Bob's Bank has no way of knowing that Charlie is not, in fact, Alice, as Charlie can provide all of Alice's information. Charlie can then listen in on, and even tamper with, Alice's subsequent browsing session.
Does this attack work and is there any way to prevent against it?