Scammers gather phone numbers from data breaches, shady websites, or by using software that generates random combinations.