A hacker obtains your email address via a data breach or purchases it from a data broker. They then employ phishing emails or SMS messages to trick you into providing your financial information and password. They may, for example, send you a bogus fraud alert email from your bank that directs you to a phishing website.