Criminals obtain e-mail addresses and telephone numbers from a variety of sources, including purchasing mailing lists from reputable companies. Often, they have no idea what financial institution you use or what credit cards you have. They just know that Tower has thousands of members and if they phish enough people, they may get lucky.