They’d need a certificate authority to issue the certificate, and the victim’s browser would have to trust that authority.

Edit: and the scammer would need to control the domain DNS server to use the subdomain, like another reply said, so the certificate alone wouldn’t help much.