JP Morgan paid millions for a startup with fake users