How Scammers Get Your Phone Number and Email Address
Scam calls feel personal, but they usually come from lists. Understanding where the lists come from shows you what you can actually change.
By Siddharth ShankarUpdated October 11, 2026Scammers get contact details from random dialing, lead generators that collect and sell numbers, data breaches and public listings such as people-search sites. The Do Not Call Registry does not stop illegal scam calls. You can cut the supply by removing listings, using separate emails, limiting public sharing and securing account recovery.
Scammers start with details that have already leaked. Is your email one of them?
Free · About 30 seconds · No sign-up · Email not stored
A call from an unknown number that uses your name, or a message that mentions a company you actually use, can make you wonder how they found you. Usually the answer is less targeted than it feels. Most contact details used by scammers come from a handful of sources, and a few of them are within your control.
1. Random dialing
The FTC says robocallers get numbers by random dialing. Software cycles through number ranges and calls everything. If your number is in the range, you are included, whether or not it appears in any list. Random dialing is hard to avoid, which is why the first rule is not to engage with calls from unknown numbers.
2. Lead generators that sell your details
The FTC has also described lead generators that collect numbers under false pretences and then sell them, with a settlement involving Response Tree LLC as an example. Some websites bury consent to share or sell data in fine print. A form that promises a quote, a prize or a free trial may be a source of leads for many callers.
Read the consent text before you submit your number to a comparison or giveaway site, and use a separate email or number for sign-ups where you can.
3. Data breaches
When a company is breached, contact details are often among the data copied. Criminals and marketers circulate those lists. Our guide to what a data breach is explains how this happens, and what to do if your phone number was in a data breach covers the response.
4. Public listings and people-search sites
People-search sites and data brokers compile names, phone numbers, emails and addresses from public records and commercial sources. Anyone can look you up. See what people-search sites are and how they get your information and what information data brokers collect.
These listings also help scammers sound credible, because a caller who knows your address or a relative's name seems legitimate.
Your best defence is knowing what scammers may already have. Check your email free.
Free · About 30 seconds · No sign-up · Email not stored
5. Your own public posts and profiles
Phone numbers and emails in social media bios, online resumes, club directories, business listings or old forum posts can be copied by anyone. Search for yourself to find them, using how to search for your email address online and how to search for your phone number online.
6. Account takeovers
If a criminal controls one of your accounts, they can read your contacts and send messages that look like they come from you. This is why securing email and enabling multi-factor authentication matters even when you think you have nothing to hide.
What the Do Not Call Registry does and does not do
The FTC says the registry targets unwanted sales calls from real companies that follow the law. It does not block calls and will not stop calls from scammers making illegal calls. Registration never expires, and you can remove your number by calling 1-888-382-1222 from that phone. Report unwanted calls at DoNotCall.gov, or at ReportFraud.ftc.gov if you lost money. It is worth registering, but it is not a scam filter.
How to shrink the supply
1Remove public listings
Start with people-search sites. See how to opt out of people-search websites.
2Use separate emails and numbers for sign-ups
A dedicated email for forms and shops keeps your main address cleaner.
3Lock down account recovery
Add a PIN to your mobile account and use an authentication app instead of text codes where possible. The FTC recommends this to reduce SIM swap risk.
4Share less publicly
The FTC advises sharing less personal information publicly as part of SIM swap prevention.
5Check your exposure
Run the phone number exposure check and the email exposure check.
What you cannot control
You cannot stop random dialing or recover data already copied from a breach. The aim is to make your details harder to find in bulk, harder to use for impersonation and harder to turn into account access.
Sources
- FTC: How are robocallers getting your phone number? (random dialing, lead generators, Response Tree)
- FTC: National Do Not Call Registry FAQs (registration never expires; removal number)
- FTC: SIM swap scams (SIM swap protection)
Frequently asked questions
Do scammers need to know who I am to call me?
No. Random dialing and purchased lists mean many calls are not targeted at you personally.
Why do they know my name?
Names often come from breaches, people-search sites and public profiles. A caller who knows your name is not necessarily legitimate.
Will changing my number stop scam calls?
Only temporarily. A new number will be shared with banks, apps and contacts again and may eventually appear in the same lists.
Should I answer and tell them to stop?
No. Engaging can confirm that the number is active. Let it go to voicemail or block it.
Where do I report scam calls?
In the United States, report at DoNotCall.gov or ReportFraud.ftc.gov. In England, Wales and Northern Ireland, use reportfraud.police.uk.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Get alerted when your email leaks
Every NordVPN plan includes Dark Web Monitor, which alerts you if your email appears in new leaks.
See NordVPN →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.