But that doesn't really explain how they got the number.

This is why I use a separate PAYG phone for banks.

And I use a separate PAYG phone for all other companies I deal with.

And I use my personal contract phone for family and friends only.

Not only does this make changing your personal number much easier (in the event you want to ditch a friend), it protects you from these scams. This is because you will know that any calls on the non-bank number are scams, and they are more likely to have the non-bank number (or rather, the number used for companies) because data leaks happen all the time. Think about all the small websites you sign up to and provide your name, address, email and mobile number - not all companies take data protection as seriously as the big boys do.

I am also convinced Amazon is responsible for data leaks. Perhaps someone could clarify this, but what information do third party sellers get from Amazon customers? They will certainly need the name and address for shipping, and I'm sure they get the phone number too as I often see it printed on the delivery label. I don't think they get the email address though.