This article may be outdated
Terms, offers, links, or instructions in this article may no longer be valid. Please verify with official sources before taking action.

[2019.12 Update] I just tested it, and some of these links are still working. I’m not sure whether Chase intentionally left them active as bait, or if they’ve just been slow to shut them down. Recently, a reader shared a shutdown case, so let’s take a look.

  • They applied through this round of offers: one CSP and one Chase Ink Preferred. Their credit history was very short before this, with only a Chase Amazon card. The stated shutdown reason was too many new account.

After seeing these examples, I strongly recommend that people do not use these links to apply for Chase business credit cards. And if your credit history is short, don’t walk into this trap. That said, since it has been quite a while without a large number of shutdown cases, if you are very confident in your profile, you can still give it a try.

[2019.11 Update 2] I saw two shutdown examples on Reddit. Let me summarize and analyze them:

  • Let’s call the two people A (ilovesojulee) and B (PM__ME_UR_BOOBS). A only had one CSP, applied for an Ink Unlimited through the leaked link, and also applied for one for their LD. Both applications went pending. After calling in to check, A got a 2 weeks result, which likely means manual review or perhaps already approved; A’s LD got a 30 days result, meaning that application had not yet been processed. At the moment, all of A’s credit cards were shut down, while the LD was temporarily unaffected.
  • B had 3 personal Chase cards and 1 business card. B applied for Ink Unlimited and Ink Preferred. At present, all of B’s credit cards were shut down.
  • A’s call results: the call was transferred to the Executive department and then to a specialist.
    • The main reason for the shutdown was applying for credit cards too quickly: 25/24, meaning 25 credit card applications within two years. (A large number of recent applications is considered a high-risk signal.)
    • A explained that the applications were for points, not to obtain more credit, and that their Balance was very small. (That is actually a very good explanation, because credit card companies first care about whether you can repay what you owe; whether you are pursuing a welcome bonus is generally less important to them.)
    • Afterward, the representative submitted a reinstatement request, with a result expected within 10 days. (Standard process.)
  • In addition, A’s LD was also around 25/24 but was not shut down. The likely reason is that the application had not yet been processed and there had not yet been a Hardpull. (As mentioned above, it was still at 30 days.) So A immediately called to cancel the LD’s application, hoping not to draw Chase’s attention.
  • B’s call results:
    • On the first call, B immediately said the applications were for points, that the account had no balance, that there was enough money to pay bills, and that the relationship with Chase was very important.
    • The representative did not listen and believed B’s application behavior was very aggressive.
    • Later, B called again, was transferred many times, and finally found someone willing to listen. The main issue was that from 2009 onward, B had only been applying for 1–2 cards per year, but the number suddenly spiked in 2018 and 2019. Also, B did not have any loans with Chase.
    • In the end, however, the representative still submitted a reconsider request, again with a result in 10 days.

My analysis and prediction:

  • Based on these two examples alone, using leaked links was not the main reason they had all their accounts shut down; the bigger issue was that their credit reports already looked very risky. I even think that if they had applied normally through standard links, they might have been denied outright, which actually would have drawn less attention.
  • From Chase’s perspective, people chasing welcome bonuses are not the primary target. The purpose of the 5/24 restriction is to filter out high-risk users. For example, if someone has recently applied for a lot of cards in order to cash out funds, that person would not be allowed to get a Chase card. A welcome bonus may only cost Chase a few hundred dollars, but unpaid balances can run into the thousands or tens of thousands. Even if the debt goes to collection, Chase might recover only 50% or less.
  • Historically, Chase has not directly shut down accounts simply because of leaked links. In my view, once you apply and are approved, that is effectively a contract with the bank; they would not normally cite the use of a certain link alone as the reason to close you down. Previously, there were similar links for Ink Bold and Sapphire Reserve, and applicants were not punished.
  • In that sense, this is different from AMEX’s recent style. AMEX mainly targets people gaming welcome bonuses and refer bonuses, which is why it has introduced pop-ups, ban refer, and claw back.
  • If you have not applied for many cards recently and you use your cards normally, then even if you used a prequalify link or even a leaked link this time, you probably will not have any issue. Based on online DP, the proportion of people getting shut down is actually quite small.

These two dp also offer a few takeaways:

  • Clearly stating your real intent, namely applying for points/welcome bonuses, is necessary, and in the bank’s eyes that is actually one of the lower-risk explanations.
  • Whether your accounts get shut down can depend heavily on the specialist you reach. Don’t give up after one bad call. Call multiple times; as long as someone is willing to submit a new reconsider request, there is still hope.
  • Having loans with Chase may reduce your risk profile. After all, making regular monthly payments can help demonstrate your financial strength.

[2019.11 Update] Although the links still worked at the time, there were already some online DP of shutdowns. However, in those cases, only the cards opened through leaked links were closed; other cards were not affected, meaning people were not fully shut down across all Chase accounts. Applications submitted through Prequalify Offer pages shown inside one’s account, including mine, were not shut down. Although those shutdown DP could not be fully verified, I still recommend that if you have not yet applied, do not use these links anymore. Entering at this stage probably will not end well.

If you are worried about a future Chase FR or a full shutdown, keep a low profile: reduce applications for other credit cards, lower the Balance on your Chase cards and pay them down early, increase deposits in your Chase Checking account, and use Secure Message to reduce the credit limits on sock-drawer cards (hotel cards down to $1,000). Also cut back on large purchases, especially buying a lot of Visa gift cards at one time.

What exactly happened?

Here is a rough timeline of events:

  • Major Chinese-language sites such as US Credit Card 101, US Credit Card Guide, and Travelafterwork successively published articles about Chase Prequalify; this time the targeting truly seemed very broad.
  • The method then spread widely through WeChat groups run by major blogs as well as private groups, leading to all kinds of creative ways to game the offer. For example, even people who had previously been fully shut down could still apply; some people opened two browsers to apply for two cards, or applied simultaneously on a phone and a computer. This also showed that these links really could bypass the strictest Chase 524 rule.
  • DOC also published related articles, but treated this as just a normal targeted offer.
  • In the comments section of US Credit Card Guide, a reader revealed that by first logging into Chase and then modifying the link, including some of the transmitted parameters, even people who were not targeted could still see the prequalify offer. The reader also provided the four-digit parameters corresponding to these three cards (for example).
  • Since these four-character parameters map to a specific card, does that mean other four-character parameters map to other cards too? People could look up the targeted offers showing in their own accounts and figure out which four-character parameter corresponds to that card. Then more and more cards became available, for example both the Freedom and Freedom Unlimited had corresponding Prequalify links. And the ones that could bypass 5/24 were the fixed APR versions.
  • If a four-character parameter corresponds to a particular offer on a particular card, why not just try all possible four-character parameters? In theory, you would just brute-force (26+10) to the 4th power. Then on the page that opens, scrape for the card keyword. If it says offer unavailable, skip it; if that keyword is not there, then scrape the card name instead.
  • This method was posted on Reddit, and some people even found links that could be used to apply directly. A quick analysis of how it works (just a guess, not from a professional coder):
    • You have to log in to use it: after logging in, your personal information is automatically attached.
    • https://applynow.chase.com/FlexAppWeb/Secured/renderApp.do?: the standard Chase application page URL.
    • Chase3FramedPage=true&cipDomain=secure05c.chase.com: this indicates where the link is coming from, namely the Chase secure05c server.
    • SPID=FYM4: this determines which card and which offer. I had previously tried changing the SPID directly too, but without the first three elements above, all I could see was offer unavailable.
  • Basically every card’s SPID was found, including things like 160,000 INK, 70,000 CSP, and $300 Freedom.
  • The original Reddit poster deleted the thread, probably because the comments below were telling people to remove those direct-application links.
  • DOC, one of the most trusted blogs in the US points-and-miles space, has a huge readership. It posted two of the most tempting application links: 160,000 INK and 70,000 CSP. After that, the whole US credit-card churning community and reader base picked it up.
  • People who had already applied started to panic. If Chase noticed, it probably would not end well.
  • 11.18, DOC had already deleted the post.
  • People started taking their own posts down as well.

What links were there?

Things to note

  • You need to log in when applying. Pay attention to whether it says FIXED APR. If it does, it can bypass the 5/24 restriction. If not, it cannot bypass 5/24, though it may still be a targeted higher welcome bonus.
  • The links below can at most bypass 5/24, or let you access a link you were not directly targeted for. They cannot bypass Chase’s rule of only 2 personal cards in 30 days (business card limit unknown).
  • They also cannot bypass the Sapphire family 48-month rule (confirmed), UA’s once-per-24-months bonus rule, or SPG Marriott / Marriott restrictions.
  • If you can’t see it, try a different browser or Incognito mode.
  • Build the links yourself.

CF、CFU、CSP、UA、Marriott、SW、CIU、CIC、CIP

  • FZZ5、FX2D、FYM4、G4C4、G2JZ、G2CJ、FZ6R、FZ6Q、G3RY

For example, CSP 70,000

  • https://applynow.chase.com/FlexAppWeb/Secured/renderApp.do?Chase3FramedPage=true&cipDomain=secure05c.chase.com&SPID=FYM4

What should we do?

Personally, I did not apply using the uncovered links. I only used the offer I had previously found in my account to apply for UA. Honestly, I just wanted to experience what it feels like to get instantly approved by Chase. Another writer here had already been shut down by Chase before, tried a direct link, and is still under review. Some people also used the direct application links because they felt they had enough assets with Chase. Others are still planning to push ahead anyway.

In any case, let me pour a little cold water on this first. Take a look at our site’s various Chase shutdown stories:

If you already applied through Prequalify

That original Prequalify Offer was not available to everyone anyway. My guess is that it was more likely to appear for people who had not applied for Chase cards recently, or for people who had applied but whose new accounts had not yet shown up on their credit reports. I do not think the issue is too serious here, since this was an offer visible in your own account. At least it suggests Chase does not view you as a bad customer.

If you do not want to draw further attention from Chase, I would suggest not applying for more cards right now. Applying for multiple cards is itself a high-risk behavior.

If you applied using modified links

Chase will very likely take action on these applications. It may shut down the newly opened card, since the offer was not actually targeted to you. It may issue the card but deny the welcome bonus. Or it may do nothing for the moment, but quietly put you through a Financial Review, and if you have other high-risk behavior, it may shut down both your new and old cards together.

I would recommend keeping a low profile: reduce other credit card applications, lower your balances on Chase cards and pay them down early, increase deposits in Chase Checking, use Secure Message to lower the credit limits on sock-drawer cards (for hotel cards, $1,000), and avoid large purchases, especially buying a lot of Visa gift cards at once.

If you have not applied yet

Refer to the two sections above and decide whether you want to step into this mess. At this point, pretty much everyone knows what is going on, and Chase almost certainly knows too. So by next week, this method probably will no longer work.

If you are not over 5/24, my suggestion is to skip it.

If you do decide to apply, then go for the highest bonus, since the nature of the risk is the same either way.

How to get your card number early and start spending

This is now dead; by Monday it no longer worked. Looks like Chase fixed this little trick too.

Chase was almost certainly going to be very slow sending cards out during this wave. If you were in a hurry to start meeting minimum spend, you could consider using the little trick below to get your card number online before the physical card arrived.

What will Chase do next?

Chase probably already had a huge pile of applications on hand by then, some instantly approved and some needing review. Since it was the weekend, everything would have to wait until Monday to be processed.

Since it was the weekend, the engineers probably could not respond immediately either. My guess is that after Monday, all of these application links would be sent for manual review until the bug was fully removed.

People who had already applied might be reviewed to see whether they were truly targeted. Based on Chase’s past practices, there does not seem to be much precedent for clawing back a welcome bonus, nor for shutting down just a single card. So the likely outcomes would be either Chase decides to eat the loss, or it shuts down all of your Chase cards.

Should you apply?

  • Use your own judgment, and take the risk yourself.
  • Use your own judgment, and take the risk yourself.
  • Use your own judgment, and take the risk yourself.