The Outlier Lab

Case Study - Chase Infinite Money Glitch (2024)

A 2024 viral trend exploited Chase's provisional availability on deposited checks to withdraw cash before bad checks bounced; Chase answered with repayment demands and lawsuits.

What happened

  • The flaw. For a period in summer 2024, a technical issue let funds from deposited checks become available for withdrawal before the checks cleared. CNBC reported it let customers take out the full value of a fraudulent check before it was returned. Press reports say the bank patched it within days of it becoming public in August. Public sources don't give an exact fix date.
  • The amplifier. Short videos framed the exploit as a free-money "glitch." This recruited ordinary account holders, many with no fraud history, in a matter of days. Later videos showed frozen accounts with large negative balances.
  • The pattern in court filings. In several suits, the check wasn't deposited by the account holder but by a "masked man" at an ATM, after which the defendant withdrew the cash. That suggests some accounts were lent or recruited, a mule pattern layered on top of first-party fraud.
  • Representative cases:
    • Southern District of Texas: a $335,000 fraudulent check deposited at an ATM; most of it withdrawn before the check was found to be counterfeit. Chase claimed $290,939.47.
    • Central District of California: Chase claimed $90,794.02.
    • Gwinnett County, Georgia: a $73,000 check deposited August 29, 2024; $82,500 in cash withdrawn at two branches before the check bounced six days later. Chase claimed $57,847.69.
    • Bankruptcy court, Grand Rapids, Michigan: a $44,779.46 fraudulent check, with withdrawals on August 30, 2024 and Cash App transfers. Chase said it might object to the debt being discharged.
Diagram: Bad check deposited (ATM or mobile), Funds made available before clearing, Cash withdrawals and P2P transfers, Check returned days later, Negative balance / charged-off loss, Demand letters, civil suits, law enforcement referral

Timeline

DateEvent
Summer 2024Technical issue allows funds from deposited checks to be withdrawn before clearing
Late August 2024Videos about the "glitch" go viral
August 29–30, 2024Deposits and withdrawals later cited in the Georgia and Michigan cases
Late August – early September 2024Chase patches the issue within days of it appearing on social media (exact date not public)
October 28–29, 2024Chase files 4 federal suits (2 against individuals, 2 against businesses) in Los Angeles, Houston and Miami. Press put the total sought at about $661K. Chase seeks the funds plus interest, overdraft fees, attorneys' fees and, in some cases, punitive damages. Repayment letters begin going out.
April 2025Chase sues more customers in state courts (Georgia, Miami, the Bronx, two Texas counties) for amounts under $75,000. It reports letters sent to 1,000+ customers and thousands of potential cases reviewed.

Mechanisms involved

Control gaps

GapWhy it mattered
Availability not tied to riskThe amount released on a deposit didn't scale with customer tenure, deposit history or check characteristics (Funds Availability Holds)
No exposure cap on uncollected fundsWithdrawals of up to roughly $300K against one unsettled item (Velocity and Exposure Limits)
First-of-kind deposits not flaggedLarge checks far above an account's normal deposit profile, followed immediately by cash withdrawals (Funding Source Signals, Customer Tenure and History)
Change-control gapA technical issue changed what was available, and production monitoring didn't catch it before social media did

Detection and response

Publicly, Chase closed the gap and then ran a long recovery program. It reviewed thousands of cases, sent demand letters, litigated the largest and clearest cases, and cooperated with law enforcement. In April 2025 it moved to state courts for claims under $75,000, which fits a triage strategy: litigate where the evidence is clear and the recovery justifies the legal cost, and use letters for the rest. Some customers repaid after the October 2024 coverage. The Michigan bankruptcy case shows a further step: Chase said it was weighing an objection to a customer discharging fraud-derived debt.

Outcome

  • Civil: federal suits (October 2024, about $661K sought in total per press) and state suits (April 2025) seeking repayment of amounts ranging from tens of thousands to about $291K, plus fees.
  • Criminal: Chase said it was cooperating with law enforcement and that its civil actions were separate from any criminal cases. No criminal charges tied to the trend have been publicly reported.
  • Total loss: not disclosed.

Lessons for practitioners

  1. Treat availability policy as a fraud control. How much credit you release, and when, is a risk decision. Scale it by tenure, deposit history, item amount relative to the account's norm, and channel. See Funds Availability Holds and Playbook - Instant Funding Abuse Members.
  2. Cap total exposure to unsettled funds as well as single items. A hard ceiling on uncollected funds per account bounds the worst case when an upstream rule misbehaves. See Velocity and Exposure Limits and Withdrawal and Payout Controls.
  3. Monitor for logic regressions in production. A sudden rise in withdrawals against uncollected funds, or in large first-time check deposits, is the kind of loss-leading indicator a sentinel should catch within hours (Playbook - Business Logic Exploit Response Members, Transaction Pattern Anomalies, Fast In Fast Out Patterns).
  4. Watch social media as a threat feed. Viral exploits recruit "normal" customers whose history makes them look low-risk. Intel monitoring (Threat Intelligence and Horizon Scanning) and a fast kill-switch (Fraud Incident Response) matter more than models trained on last year's fraud.
  5. Plan recovery before you need it. Triage by amount and evidence strength, use demand letters at scale, keep litigation for the clearest cases, and be ready for bankruptcy discharge attempts. Clean labels (Fraud Labeling and Feedback Loops) and SAR obligations (BSA-AML and SAR Filing) still apply.
  6. The pattern travels across industries. Brokerages extending instant buying power on unsettled ACH, and cashback apps paying out before a purchase is confirmed, face the same gap between availability and settlement. Compare Case Study - Robinhood Infinite Leverage Glitch (2019) and Case Study - Pinduoduo Coupon Exploit (2019), and see Brokerage and Investing and Cashback, Coupons and Rewards.

Sources