A bank created fake accounts, forced clients into unnecessary car insurance and repossessed vehicles when they didn’t pay. Now it has agreed to $20 million in penalties