>Another question: how do these scammers get mobile numbers? I suspect there are many online personal data breaches which are never reported e.g. a breach from an online retailer, or maybe a friend with your contact details who has been hacked.

try every number? It's not like phone numbers have high entropy.