Phone numbers are all over the internet. They get the card number from a carbon (probably with a reference somewhere as to which cards belong to which bank) and your name (which would appear on the card itself). The rest is academic.

The other way would be a using the number off the receipt. Some places track your purchases based on your phone number and this ends up on the receipt along with name and card number. Since many people think nothing of throwing away their receipts after their done (rather than taking it home or to work to shred), it's a matter of grabbing it out of the public garbage.