I sometimes get them from "banks" that I don't have an account with.
If I was a younger, tech-savvy type, I would write a program that would flood their servers with thousands of fake "user IDs " and fake passwords, then they would have to waste all their time checking them out and finding they don't work.