He goes to prison?

But seriously, I wouldn't even look for holes in any payment system without prior indemnification.

Hell, I work as a security consultant for a living and any time I touch live finance systems I tread very lightly. Any significantly complex system with money directly involved is going to have too many variables to predict its behavior. I wouldn't touch something like this with a ten foot clown pole.

Presumably this is being run through a real bank with a real underwriting department. A VISA card that works at ATMs is not fun-and-games; it's not a Facebook feature.

Yea, this is well into the realm of going to jail for a long time if you touch anything. Find it pretty doubtful that anyone will even try.

Indeed. It's a Chase Visa card :)

From what I understand, it looks like basically a branded VISA gift card. The interface to add value to the card is going to be something VISA controls, not Facebook. So searching for weaknesses to add value to the card is equivalent to searching for weaknesses in the VISA network.

If that's incorrect, someone who knows more can correct me.

That is correct.

The card is a Chase Paymentcard (https://www.mychasepaymentcard.com/). None of us have authorization to mess with Chase's applications. ;-)

Since Facebook has only given money to 81 people so far, I'm going to guess this is a very manual procedure. There's probably only one guy somewhere that can authorise these things. It's not like they have (or can have) an automated 'bug bounty software'.

His hat changes color?