Eleven people have been sentenced to federal prison for a parking-lot scam in the Hampton Roads area of Virginia that targeted credit union members in public places. The U.S. Attorney’s Office for the Eastern District of Virginia said on Sept. 25, 2026, that the longest term was three years and six months. According to the office’s announcement, the group got victims to hand over their phones through deceit and intimidation, then used them to reach bank accounts.

Affiliate links — we may earn a commission.

What happened in the parking lots

The Justice Department says the scheme ran since at least January 2023. Fraudsters approached people in publicly accessible places, and the announcement’s headline calls it a credit union parking lot scam. Once a phone was in their hands, prosecutors say, the thieves opened the victim’s banking access and made unauthorized loan applications, disputed transactions, made transfers and took out withdrawals. They also collected the victims’ personal information.

The announcement does not give a dollar loss or a count of victims, and it does not name any. It also does not say what the thieves said to get a phone. That leaves the risk easy to describe and hard to size.

Anyone who carries a phone loaded with a credit union app is in the group this scheme went after. The announcement says the targets were credit union members in the Hampton Roads area, and it does not say whether other areas were hit. Phones are not the only thing that links a person to a bank. A name, address and phone number also sit on people-search sites, and Incogni sends removal requests to those brokers for you, which cannot undo a phone handed over in a parking lot but does shrink the lists.

The eleven sentences

Steven Carter Jones III, 33, pleaded guilty to wire fraud and conspiracy to commit wire and bank fraud and was sentenced to three years. Corey Deshawn Smith, 32, pleaded to wire fraud and conspiracy to commit wire fraud and received two years and seven months. Troy Lee Davis III, 26, was sentenced to two years and six months, and Laterrance Octavia Parker Jr., 25, to three years and two months. Jordan Pugh, 34, got three years and four months. Jamaica Lavonta Sumner, 26, got one year and nine months. Rodney Demetrius Thornton, 40, received the longest term, three years and six months. Davis, Parker, Pugh, Sumner and Thornton pleaded guilty to the same two counts as Jones.

Four others pleaded to conspiracy to commit money laundering. Joy Davis, 48, was sentenced to two years and six months, Andrea Holley to one year, Lois Irene Staton, 33, to six months, and Persia Brown, 25, to four months. Judge Jamar K. Walker imposed the sentences. They were handed down on different dates, from May through Sept. 24, and the announcement collects them in one place.

A second case against one defendant

Jones faces more time in a separate case. He pleaded guilty in April to fentanyl distribution and to possessing a firearm in furtherance of drug trafficking. Sentencing there is set for Feb. 9, 2027, with a 10-year mandatory minimum and a possible maximum of life in prison. That case is not part of the three-year fraud sentence.

Who investigated

The U.S. Secret Service’s Norfolk office investigated, with Resident Agent in Charge Matthew Lake named in the release. First Assistant U.S. Attorney Theophani K. Stamos announced the sentences, and Assistant U.S. Attorney Clayton D. LaForge prosecuted. The cases carry the numbers 2:25-cr-105 and 2:25-cr-128.

If a stranger asks for a phone, or already has one

The Federal Trade Commission’s guidance for people who have been scammed says that anyone who gave a scammer access to a phone should update security software, run a scan and delete what it flags, change passwords and turn on two-factor authentication. It says a person who paid through a bank or credit union should report it to that institution right away and ask for a reversal. The page has no specific steps for a scammer who got into a bank account itself, and it says to contact the bank or credit union directly, using the number on the card or statement rather than one a stranger supplied.

People who gave out a Social Security number can report it at IdentityTheft.gov, which the FTC runs to give a recovery plan. Reports of scams go to ReportFraud.ftc.gov. The FTC says it uses them to build cases against scammers and spot trends.

In practice, the first hour matters: a call to the credit union, new passwords, a look at pending loan applications and transfers. Writing down the time, place and a description of whoever asked for the phone gives the credit union and investigators something to work with.

Eleven sentenced, and members still carry phones

The people sentenced in Hampton Roads took phones, not databases, and a phone is only one way a thief learns a name and number. Incogni asks data brokers and people-search sites to remove personal information, sends removal requests on a person’s behalf and keeps re-sending them. Less personal data on broker lists can mean fewer scam calls, texts and emails, and each request’s status shows in the account.

Have Incogni ask data brokers to delete a phone number and address →

This article was produced with AI assistance and edited for accuracy against the sources linked above.