Chris Hondros /Getty Images People use ATMs at a Chase branch bank

The Consumer Financial Protection Bureau ordered Chase and JPMorgan Chase to refund $309 million in charges to more than 2.1 million people and pay a $20 million fine for illegal credit-card practices. And yet, that may not change much.

Chase charged people for services like “identity-theft protection” and “fraud monitoring.” These services — for which customers paid between roughly $8 and $12 a month, sometimes for years — were not always necessary. Credit-card companies monitor customer accounts for fraud anyway.

In some cases, the CFPB says Chase didn’t even perform the service it claimed to be advertising. Some customers found themselves signed up for these services even though they hadn’t given the company permission to enroll them. Sometimes those monthly charges bumped customers over their credit limits, so Chase slapped them with fees for that too.

The CFPB says customers who still have their Chase credit cards will be issued credits to their accounts for the amount they were billed for the services plus any other fees they were charged as a result. Former customers will get checks in the mail. Everybody should get their refund within a couple of months, the agency says.

(MORE: CFPB Cracks Down on Lies in Credit-Card Marketing)

Last year, the financial watchdog penalized Capital One and Discover Financial Services for similar practices, and credit-card companies including Bank of America, JPMorgan Chase and Citigroup scaled back add-ons like “payment protection” — another service that’s marketed as something that protects customers but doesn’t really provide much benefit.

More actions could be coming. Bank of America said in a regulatory filing this summer that it “has been in discussions with regulatory authorities to address concerns regarding the sale and marketing of certain optional credit card debt cancellation products,” and that it might be fined or have to pay refunds to customers.

(MORE: CFPB Shows Its Teeth: Capital One Fined $210 Million for Deceptive Marketing)

But these kinds of services are big moneymakers for credit-card companies — according to the Wall Street Journal, Discover earned $101.2 million from add-ons like payment and identity-theft protection in just one quarter last year — so it’s not surprising that even the threat of fines or other enforcement isn’t enough to keep them from coming back to them.

Industry-trade magazine American Banker reports that American Express, Wells Fargo and Citigroup all continue to sell add-ons to credit-card customers. American Express is selling a credit-monitoring product for around $15 a month, even though the company ran afoul of the CFPB last year over its marketing practices. Since the CFPB’s complaints so far have focused on how the products were marketed, rather than whether or not the services actually benefited customers, these banks seem willing to gamble that changing how they pitch these products will keep them out of trouble.