I can imagine that something like this happened: 1. Based on the disclosure, usage of multiple sessions was marked as possible fraudulent activity 2. When a new signal for fraudulent activity is added, accounts and transaction in the past are checked as well 3. OP's account comes up as fraudulent activities (ofcourse it does, he's the one who found it) 4. Nobody at Chase takes the effort to see what exactly happened here and that this account (or at least the specific transaction) should be excluded from positive results

Remember that Facebook reported the BBC to the police for telling them there was CP on their network [0]? I think something similar happened.

[0] https://gizmodo.com/bbc-tells-facebook-about-child-porn-on-t...