Unexpected piece of mail had north suburban man's private information printed for anyone to see

CHICAGO (CBS) -- A birthday card or a check in the mailbox will put a smile on your face, but when it's junk? Cue the eyeroll.

You might want to look twice at those advertisements and unsolicited marketing materials. Morning Insider Lauren Victory shows us the junk mail that shocked a north suburban man.

"I couldn't fathom why in the world I'd gotten this and how this had happened," said a man named Mike, holding a piece of mystery mail.

The envelope and contents inside spooked Mike so much that he didn't want us to share his last name.

"This is where I'd expect to see 'Hello Mike,'" he said, pointing to the top left corner of the promotional materials. "There's not a name, not a name of a business, it's just my number followed by a comma."

His social security number that is. The extremely sensitive information was also visible through the envelope window for anyone to see. It was printed on a debit card inside the mailing too. Mike says he never applied for a debit card.

"It got me really worried that, A, there was potentially my money on there; and, more importantly, why is my social security number plastered all over the documents?" he said.

Financial services company "Square" appears to be the sender. You've probably seen Square's credit card machines at your neighborhood business, or perhaps you've swiped to pay on Square's tiny reader that attaches to a phone. 

Then there's the Square Debit Card, which is explained as "…a business debit card that comes with your business checking account…" in a company YouTube video. 

"I don't have a small business," said Mike. "I work for a company, so I don't have any need to contact Square or any need to give them information for business use."

Square representatives promised Mike they'd investigate. The company's email to him included a somewhat ironic response – that its "security and privacy policy" prevented them from disclosing further information.

Could Mike's unsettling situation have been the work of a third party? Was it friendly fraud where someone Mike knows set him up?

CBS 2 asked Square those questions, and also asked Governors State University fraud expert Bill Kresse what he thought.

Kresse, who goes by Professor Fraud, said he does not think this was the work of scammers.

"Unless they [scammers] somehow hacked into Square's system and produced mailing labels with social security numbers on it," he said.

Square denied this was a data breach or a marketing mistake, suggesting to CBS 2 that Mike may the victim of identity theft.

In an official statement, a spokesperson said: 

"Square operates with the highest standards of identity verification. To receive a Square Debit Card, customers are required to provide key information, including their legal name, social security number, and home mailing address, among other details. Unfortunately, millions of individuals in the US have their personal information compromised annually through various data breaches that occur off of Square's platform and in some instances, fraudsters are able to use this compromised information to open fake accounts at financial institutions such as Square. We continuously invest in proactive fraud detection, risk, and security systems in order to identify, mitigate, and deactivate fake accounts."

"If a consumer believes they have received a Square Debit Card in error, they should immediately contact us at 855-700-6000 to get the card deactivated and close the account. Additionally, consumers who believe they are the victim of identity theft should file reports with the appropriate authorities and contact the three credit bureaus to prevent further fraud."

But Kresse said it still wouldn't make sense for this to have been fraud, because a fraudster isn't going to make money by mailing out unsolicited debit cards to their victims.

Mike is hoping it's just a Square glitch, but still has several questions as he nervously monitors his mailbox for anything else suspicious.

"This is not letting me sleep well at night," he said.

Professor Fraud said this situation is a good lesson for all about closely examining junk mail. Don't just toss it in the garbage can, because a scammer could pluck it out and use your information. Instead, always shred mail, he said.

We asked Square what could possibly be the end goal of someone committing identity theft if the debit card arrives in the victim's mailbox. Square would not speculate.