Having official public contact information, well, public, is fine - that's the point. But having the email addresses associated with merchant accounts isn't. Hence the phishing concern.