My friend likes to phish. He used to go out dumpster diving at accounting offices, small dentist offices, the DMV, and employment staffing agencies. He only found a few SSN and other personal information.
He once set up a fake job listing on Craigslist, set up an account at a paid phone number spoofing service to disguise the number as a local employment staffing agency, made an editable PDF application that looked like it came from the staffing agency, and then replied to any emails he got about the job by calling them and telling them that he wants to interview them but he needs to first get their application so that he can do a background check(basically pressure them to do quickly), and caught some SSN along with other information.
He's gotten much better catches in the sea of the internet via penetration testing.
