As an example, my parents have been bombarded with calls from a scammer who it seems only has their phone number and email address, but that’s enough to give aw

As an example, my parents have been bombarded with calls from a scammer who it seems only has their phone number and email address, but that’s enough to give away their full names and the name of the ISP, so the scammer is using it to call and pretend to be the ISP support trying to trick them into giving up 2FA codes from password reset attempts they do at the same time while calling that phone. You don’t need much info to go a long way!