Hi @gaytonpw ,

Welcome to Trend Micro Home Users Community!

There are multiple ways on how the scammers got an access to her email address.

Here are some of the reasons:

1.) The user has signed up to a malicious website using her email address and password.

2.) The user has signed up to a malicious email that is pretending to be from a reputable company.

3.) The user installed a malicious app either on her mobile phone, laptop or desktop that is allowed to collect data within her device (Full scans of Trend Micro Antivirus should detect these types of apps, but if you dont have the protection installed, like on your mobile phone that can be a vulnerability that these malicious apps can exploit).

Let me know if you have further questions.