A Rowlett woman and a Dallas woman have been sentenced to 24 months each in federal prison for their roles in a scheme that used stolen customer identities and fake IDs to raid JCPenney store credit accounts across the country. Cabria Cunningham, 27, and Mykiah Furlough, 27, were also ordered to serve one year of supervised release and pay victim restitution after their sentencing on Friday.
U.S. District Judge David Hittner handed down the sentences, according to the U.S. Department of Justice, which detailed how Cunningham pleaded guilty on Sept. 5, 2025, while Furlough entered her guilty plea on Feb. 19, 2026. The case was also announced by the US Attorney SDTX on social media, the official account of the United States Attorney's Office for the Southern District of Texas.
How the Scheme Worked at the Register
Throughout 2022 and 2023, the co-conspirators traveled to JCPenney locations nationwide, presenting stolen customer personal information along with fake identification at checkout to gain access to store-branded credit card accounts, per the DOJ's account. Once inside those accounts, they purchased merchandise and gift cards, then resold the stolen goods on social media, according to the same release.
The scheme's mechanics reflect a pattern federal officials have flagged well beyond this single case. Industry reporting from the National Retail Federation notes that organized retail crime rings frequently use stolen personal data to execute store credit account takeovers and obtain gift cards that are rapidly converted to cash or resold through digital marketplaces.
The Recruiter Awaits Her Own Sentencing
Federal prosecutors said Ashley Urune, 34, of Dallas — a relative of Furlough — recruited both Cunningham and Furlough into the conspiracy, per the DOJ. Urune pleaded guilty to wire fraud conspiracy and aggravated identity theft and is scheduled for sentencing on Dec. 3, 2026, the release states.
The investigation was carried out by the U.S. Postal Inspection Service with assistance from the U.S. Marshals Service, and the case was prosecuted by Assistant U.S. Attorney Stephanie Bauman, according to the DOJ announcement.
Why the Sentence Was Fixed at Two Years
The 24-month terms trace directly to federal sentencing law. Under 18 U.S.C. § 1028A, a conviction for aggravated identity theft carries a mandatory two-year prison sentence that must run consecutively to any sentence for an underlying felony fraud count and cannot be served on probation, per Cornell Law School's Legal Information Institute. Congress built the statute to stack a fixed prison term on top of predicate crimes like wire fraud, leaving federal judges no room to reduce or run the sentence concurrently.
A Growing Problem Across Texas
The case lands amid a documented surge in identity theft losses statewide. Figures released by the FBI's Dallas Internet Crime Complaint Center show Texas residents lost more than $70.4 million to personal data breaches and account takeover schemes in 2024, up sharply from roughly $31 million in 2023, as Hoodline previously reported. Nationally, the Federal Trade Commission logged over 1.35 million identity theft complaints in 2025, contributing to consumer fraud and identity theft losses exceeding $15.8 billion, per data cited by Experian.
Locally, the Dallas County District Attorney's Office maintains a Specialized Crime Division with a dedicated Fraud Unit staffed by eight attorneys and five investigators who target organized retail theft, credit card abuse, forgery, and complex financial crimes, according to the office's own description of its Fraud Unit.
What Victims Can Do
The Federal Trade Commission instructs individuals whose identities are stolen for credit fraud to place fraud alerts with the three major credit bureaus — Equifax, Experian, and TransUnion — freeze their credit files, and submit an official report at IdentityTheft.gov to dispute fraudulent accounts, according to guidance published by USA.gov. An official FTC affidavit is required to clear unauthorized retail credit balances stemming from cases like this one.
