I feel like Google as a whole are aware this could be used for phishing, and will have methods preventing malicious use.