JPMorgan Chase & Co was accused by federal regulators of duping millions of customers into buying costly and unneeded credit card services. (MIKE SEGAR/REUTERS)

Federal regulators Thursday slapped JPMorgan Chase with $389 million in penalties for deceiving millions of customers into buying costly and unneeded services when they signed up for credit cards.

The nation’s largest bank will pay $309 million to reimburse about 2.1 million consumers who were duped into paying for credit monitoring and other add-ons between October 2005 and June 2012. Those consumers enrolled in and paid for identity theft protection products but did not receive the full benefit of the products, according to the Office of the Comptroller of the Currency.

The bank regulator hit JPMorgan with an additional $60 million civil penalty based, in part, on the scope and duration of the violations. The OCC also is requiring the bank to take a number of corrective measures, including developing a better risk-management program for consumer products marketed or sold by JPMorgan or its vendors.

In coordination with the OCC, the Consumer Financial Protection Bureau levied a separate $20 million penalty in the case.

“We continue to be vigilant in pursuit of those who deceive consumers or treat them unfairly,” Richard Cordray, director of the CFPB, said in a statement. “Consumers deserve better, and we intend to help them achieve that.”

Cordray said JPMorgan often charged consumers for credit-monitoring products before the bank had obtained written authorization to perform the service, a violation of the law. In many cases, the bank never received authorization but started billing customers for the service all the same.

“When the fees for the products exceeded credit card account limits, some consumers faced even more fees and paid additional interest on those amounts,” Cordray said.

JPMorgan said it has already made refunds to affected consumers.

“We stopped new enrollments in these products in mid-2012 and will fully exit them by the end of this year,” Bill Wallace, JPMorgan’s head of operations for consumer and community banking, said in a statement. “Any mistakes like these are regrettable and we are committed to ensuring our partners and vendors hold themselves to the same high standards that our customers expect of us.”

The enforcement actions arrived on the same day as a flurry of other orders against JPMorgan. British and U.S. regulators, including the OCC, handed down a total of $920 million in fines against the bank for its disastrous “London Whale” trading losses from last year. In a separate action, the OCC also issued a cease-and-desist order for the bank’s use of flawed documents and incomplete records to collect on delinquent credit card debts.

JPMorgan chief executive Jamie Dimon this week sent a memo to employees that outlined steps the company has taken to address its risk-and-compliance problems. He said the bank has decided to no longer sell identity-theft protection and credit insurance to customers.