An elderly friend received a telephone call similar to this Information Security SE post and this one.
The caller claimed that my friend's computer had a problem that needed to be fixed. My friend was savvy enough to quickly identify this as a scam, and refused to provide any information.
What set the call apart from those other SE posts was that the caller claimed to know my friend's "Windows unique identifier" (or something close to that). Guessing that my friend has a Windows device is not hard: about 90% of computers use some variety of Windows. I'm not sure what the caller meant by "Windows unique identifier", but I'm guessing they were referring to the Windows Product ID.
My friend wasn't interested in spending any time on the call or verifying any information, but it sounded like the caller was prepared to provide a unique ID that my friend could verify on her computer.
There are many pieces of data that can easily be gleaned about a computer just by visiting a website. To my knowledge, the Windows Product ID is not one of those pieces of information.
The insistence by the caller that she could provide my friend's "Windows unique identifier" is concerning.
To keep this question narrow, let's assume that my friend has no malware installed on her system. (I had her perform several thorough scans with different products, and it tested clean on all of them. I also had her use a Linux CD-ROM with several scanners on it, so she could boot from it and perform more scans... everything showed clean. I reviewed her system and firewall logs, and did not find anything abnormal.)
Let's also assume the caller was not bluffing, and really did have a verifiable "Windows unique identifier" or Windows Product ID.
Is there some sort of "Windows unique identifier", perhaps the Windows Product ID, that is transmitted by any common browsers or browser addons/extensions?
Is the Windows Product ID relatively unique, or does every computer manufacturer just use a small number of Windows Product ID's when they pre-install Windows on their systems, thus making it fairly easy to guess?
If the answer to #1 is "no", and the answer to #2 is that they are relatively unique, and assuming that she has no malware, how could a scammer get a hold of that information?
Note that, despite my recommendations, she has a subscription to one of Symantec's Norton Antivirus/Security products. Has Symantec had any breaches in which such data could have been stolen? I do insist that she perform frequent scans with other products as well.