I don’t know enough about actual fraud but know quite a lot about data & breaches and funnily last week at work we had a girl in my team have someone try to commit fraud on her *retailer* account as her details had been compromised and she recycles passwords:
If a site has been compromised - say Airbnb or dominoes etc which has your email, phone number, possibly card details but not always, etc etc these lists live on in the dark web and people can buy them. So say you’re using [email protected] and password is secret - someone can write a script to whizz through that csv file and try all of those emails & passwords on PayPal, on John Lewis, etc to try it out under the knowledge most people password recycle. I don’t fully understand how the delivery element of it occurs to be honest, most often at work we see fraud used to buy gift cards that they they are emailed because it’s quicker & obviously no paper trail on delivery addresses. But we have also seen frauds that get delivered to addresses, most often flats so they’ll deliver to the building and intercept the package so the wrong address doesn’t get it.
Regarding banking obviously there are multiple steps to it and it is a lot harder, but if you were to cross reference multiple leaked sources I imagine it’d be feasible to build up a pretty good picture. But that’s why most often now you see bank scams over mobile, you’ll get texted a link that looks like it’s from Natwrst or whoever and you go in and fill in the form and complete the job for them. Or they’ll call you up, and because they have x y z on you, you believe they’re the bank and you pass your own security test for them.
I mean I don’t understand enough about PAC or telecoms to comment on that at all but I can fully believe it from a web data PoV. I’ve also worked in places where they’ve stored full card numbers unencrypted in their databases (literally criminal now) and had analysts with PII on hard drives they leave on their desks so I believe anything is possible sadly
