Indeed sell access to candidate information uploaded to their platform (including contacts). Can't remember whether it's clearly communicated to candidates or opted out by default or not, but there's a use case for that service and I've helped make legitimate hires using it before.
But for the scammer it's easy enough to quietly use an Indeed business account completely unrelated to their scam, buy a bunch of resumes from people who have actually applied for jobs in a certain field on Indeed, and contact those candidates, pretending to be a different business that posted real job ad for that job on Indeed.
It also helps that Indeed users tend to one-click apply to large numbers of jobs so might believe they actually applied to that specific job, or otherwise trust some clever job-matching stuff is happening with their resume. Especially since most of the time it'll be their actual resume the "employer" responds with, not just their LinkedIn profile info
But for the scammer it's easy enough to quietly use an Indeed business account completely unrelated to their scam, buy a bunch of resumes from people who have actually applied for jobs in a certain field on Indeed, and contact those candidates, pretending to be a different business that posted real job ad for that job on Indeed.
It also helps that Indeed users tend to one-click apply to large numbers of jobs so might believe they actually applied to that specific job, or otherwise trust some clever job-matching stuff is happening with their resume. Especially since most of the time it'll be their actual resume the "employer" responds with, not just their LinkedIn profile info