This is true. The phishers can be criminals, the government can also, but they less likely will resort to that.