Re: the concern by the credit card companies.
The issue is that you're paying your credit card bill with funds that the credit card company isn't 100% sure of.
A criminal with access to some phished accounts could use them to pay a credit card account. Even if the funds clear initially, they could be rescinded if the real account holder disputes it. You have 30 days after you get your statement to dispute a transaction on it; this could be up to 60 days after the actual transaction.
A criminal is going to pump as much through the credit card as possible to get the maximum return before they're found out. So he maxes out the account, or tries to pay ahead to get even more through.
The reason for using the credit card rather than the bank funds directly is that it adds an additional layer to obfuscate what's going on, and to take advantage of the float to keep the scam going longer.