In this case, though, what’s the damage? These attacks happened in a spike and all the accounts overdrawn are tied to social security numbers and real life folks through provable links (assuming Chase did its fucking job during account registration)… Chase can recoup the losses pretty trivially and they should have a literal bank ledger of every transaction. So direct monetary damages seem nil assuming people haven’t lost the money (and I’m only advocating for no additional punishment if the parties can make Chase whole).

Then what about deterrence - we punish people to discourage future criminal actions… this loophole is closed and nobody can exploit it in the future. Additionally, given the flash mob nature of this, I don’t think any bystanders would see the response to this and think “Fuck, I’m going to check fraud myself” the event is over, the window has passed.

So I feel like any additional punishment (again, beyond reclaiming the fraudulently withdrawn money) would just be vengeful - and I don’t think vengeance based punishment is moral.