The first six digits of a card number are called the issuer identification number; they indicate the card issuer and - often - the card product. All it would take is a compromise of a merchant database to provide the necessary details for a phishing attack like this.

The first digit identifies the card network, so all Amex cards begin with 3. The first six digits of my Amex Delta platinum card number are 377247, and while that’s merely one of many IINs Amex uses, I suspect a scammer would be pretty safe guessing that any card beginning in that number is a Delta cobrand.