How Scammers Get Your Phone Number and Email
How did scammers get your number or email? Data leaks, contact list apps, social media, public listings and simple guessing, and what you can do to reduce the flow.
You have never given your number to a "prize department" or a "crypto adviser", yet they keep messaging you, sometimes by name. It feels personal and unsettling. In most cases it is not personal at all. Your contact details have simply ended up on lists that scammers buy, trade or build, and there are several ways that happens.
Where scammers get numbers and emails
1. Data breaches and leaks
When a company is breached, customer records often include names, phone numbers, emails and sometimes addresses and birth dates. These datasets are traded and combined. You may never have heard of the breach, but your details can circulate for years. A free service such as Have I Been Pwned lets you check whether your email or phone number appears in known breaches.
2. Contact list and caller ID apps
Some apps upload users' address books to identify callers. If a friend or colleague has installed one, your number and the name they saved it under may have been shared, even though you never used the app.
3. Social media and public profiles
Numbers and emails listed on profiles, business pages, CVs, marketplace adverts, church or club group pages, and professional directories are easy to collect automatically.
4. Group chats and online communities
Large WhatsApp and Telegram groups expose every member's number to everyone else in the group. Scammers join public groups specifically to harvest numbers.
5. Guessing
Phone numbers follow predictable formats. Automated systems simply dial or message number ranges and note which ones respond. Email addresses can be guessed from common patterns such as firstname.lastname at popular providers or at a company's domain.
6. Forms, competitions and sign-ups
Fake quizzes, giveaways and surveys exist mainly to collect contact details. Some legitimate sites also share or sell data to marketing partners, which can eventually leak.
7. Engagement signals
Replying, clicking a link, or even answering a call can confirm your number is active and responsive. Active numbers are more valuable and get targeted more.
A scam message using your name is not proof it is real. Names, and sometimes addresses and recent purchases, come from the same leaks. Judge the request, not the details.
What you can reduce
You cannot make your number or email invisible, but you can reduce how widely it spreads and how often you are targeted.
- Do not engage. Do not reply, even to say "stop" or "wrong number", and do not click unsubscribe links in scam messages.
- Silence unknown callers where your phone or apps allow it. WhatsApp, for example, has a setting to silence calls from unknown numbers.
- Review your privacy settings so only contacts can see your number, profile photo and "about" information in messaging apps.
- Remove contact details from public profiles where you do not need them, or use a separate business number or email for listings.
- Leave large public groups you do not need, and adjust group settings so strangers cannot add you.
- Use email aliases or a secondary address for shopping, competitions and newsletters.
- Report and block scam numbers and senders, which helps networks and platforms filter them for everyone.
What actually protects you
Reducing exposure lowers the volume, but some messages will always get through. What protects you is how you respond:
- Treat unexpected messages and calls as unverified, however much they know about you.
- Never share codes, passwords or PINs because someone asked.
- Check through official channels you find yourself.
- Use a unique password and two-step verification on important accounts, so a leaked email address alone cannot be used to break in.
Got a message you are unsure about? Paste it into CyberWatch AI Scan for a free check.
Why do some people receive more scams than others? See how scammers choose their targets. For the full picture of how scams work and how to stay ahead of them, read the complete guide to online scams.
Frequently asked questions
Does getting a scam message mean I have been hacked?
No. Most scam messages are sent to numbers and addresses from leaks, lists or guesses. It means your contact details are known, not that your device or accounts have been accessed.
Should I change my phone number because of scam calls?
Usually not. A new number will eventually be found too. Filtering unknown callers, reporting spam and never engaging are more effective.
How do scammers know my name as well?
Names are often included in leaked data, or linked to your number in contact-sharing apps and public profiles. A message using your name is not proof it is genuine.
Sources
- Have I Been Pwned, Troy Hunt
- How to silence unknown callers, WhatsApp Help Center
- Social media: how to use it safely, UK National Cyber Security Centre
