FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA, No. 19-10430 Plaintiff-Appellee, D.C. No. v. 2:17-cr-00225-

TLN-1

LUIS JOSE RUIZ GAINZA,

Defendant-Appellant.

UNITED STATES OF AMERICA, No. 20-10009 Plaintiff-Appellee, D.C. No. v. 2:17-cr-00225-

TLN-2

RICARDO GABRIELE-PLAGE,

Defendant-Appellant. OPINION

Appeal from the United States District Court for the Eastern District of California Troy L. Nunley, District Judge, Presiding

Argued and Submitted October 16, 2020 San Francisco, California Filed December 8, 2020

Before: M. Margaret McKeown and Jacqueline H. Nguyen, Circuit Judges, and Eric N. Vitaliano, * District Judge.

Opinion by Judge McKeown

SUMMARY **

Criminal Law

The panel vacated the sentences imposed on two defendants who pleaded guilty to multiple offenses— including conspiracy to possess unauthorized access devices, access device fraud, and aggravated identity theft— arising from the installation of cameras and skimmers at ATMs near Sacramento, and remanded for resentencing.

In calculating the amount of loss caused by the scheme under U.S.S.G. § 2B1.1(b)(1), the district court concluded that the defendants obtained account information for each person who visited the ATMs while the cameras and skimmers were installed.

The panel held that the district court’s application of a twelve-level increase to the base offense level under

* The Honorable Eric N. Vitaliano, United States District Judge for the Eastern District of New York, sitting by designation. ** This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.

UNITED STATES V. GAINZA 3

U.S.S.G. § 2B1.1(b)(1)(G) was clear error because the record does not support the conclusion—even based on a reasonable estimate—that the defendants obtained 852 and 754 account numbers respectively. The panel wrote that while the government showed how many people used the ATMs while the skimmers were installed, it did not provide any evidence of the skimmer success rate, without which the record cannot support a finding that the defendants obtained information “that can be used to initiate a transfer of funds” from each ATM customer, as required by 18 U.S.C. § 1029(e)(1).

COUNSEL

Kresta Nora Daly (argued), Barth Daly LLP, Davis, California, for Defendant-Appellant Ricardo Gabriele- Plage.

David M. Porter (argued), Assistant Federal Defender; Heather E. Williams, Federal Defender; Office of the Federal Public Defender, Sacramento, California; for Defendant-Appellant Luis Jose Ruiz Gainza.

Brian A. Fogerty (argued), Assistant United States Attorney; Camil A. Skipper, Appellate Chief; McGregor W. Scott, United States Attorney; United States Attorney’s Office, Sacramento, California; for Plaintiff-Appellee. McKEOWN, Circuit Judge:

The lesson in this case is that trying is not the same as succeeding. Over the course of a few days in April and August of 2017, hundreds of people used three Golden 1 Credit Union ATMs near Sacramento, California. Unbeknownst to them, a hidden camera had been installed to film their fingers as they entered their PINs. A “skimmer”—a credit-card-sized tool that is placed into an ATM to record the information of inserted cards—had also been installed.

The responsible parties were Luis Ruiz Gainza and Ricardo Gabriele-Plage, who pled guilty to all charges. The issue on appeal, which bears only on sentencing, is how much loss the scheme caused. In calculating the loss amount, the district court concluded that Gainza and Gabriele-Plage obtained account information for each person who visited the ATMs while the cameras and skimmers were installed. But while there is evidence that Gainza and Gabriele-Plage hoped to obtain account information for each ATM customer, there is insufficient evidence that they succeeded in doing so. The district court’s conclusion to the contrary was clear error, so we promptly vacated the sentences and remanded the cases for resentencing. 1

1 On October 20, 2020, we issued a brief order vacating the sentences and remanding for expeditious resentencing. The order stated that the mandate would issue forthwith, that the panel would retain jurisdiction, and that this opinion would follow. On remand, the district court provided the government with an opportunity to proffer additional evidence, and the government declined to do so. The district court then

UNITED STATES V. GAINZA 5

BACKGROUND

The scheme began in April 2017. Gainza, acting without the help of Gabriele-Plage, installed a skimmer and camera at the Golden 1 ATM on Auburn Boulevard just after midnight on April 6. He returned an hour later to check the skimmer and adjust the camera. The next evening, three unidentified individuals removed the skimmer and camera. As part of its investigation, Golden 1 used surveillance video to determine how long the skimmer was installed. Then, using transaction records, Golden 1 determined that 109 customers used the ATM while the skimmer was installed. Of those customers, 37 made fraud claims totaling $20,781.60.

On August 2, Gainza and Gabriele-Plage together installed a skimmer at the El Dorado Hills Golden 1 ATM. Gabriele-Plage removed the skimmer 12 hours later, and Golden 1 reported that 178 customers used the ATM in the interim. Unlike the April incident, however, no ATM customers reported any fraud.

They returned to the same location on August 3— installing a skimmer shortly before 1:00 a.m., and later a video camera. Both were removed at 7:00 a.m., and Golden 1 reported that eleven customers used the ATM during this time. Once again, no fraud claims were made.

The third attempt at this location went awry. The skimmer was installed just after midnight on August 4, and a camera was installed a few hours later. But before they

resentenced Gainza and Gabriele-Plage to time served. See United States v. Gainza, No. 2:17-cr-225 (E.D. Cal., Oct. 29, 2020), ECF Nos. 128, 131–132. could remove the skimmer and camera, an ATM technician discovered the skimmer and removed it. Golden 1 reported that 228 customers used the ATM before the skimmer was removed. No fraud claims were reported, and because the skimmer was removed by the ATM technician, Gainza and Gabriele-Plage did not obtain any account information.

After the skimmer was discovered at the El Dorado Hills location, Gainza and Gabriele-Plage returned to the Auburn Boulevard location. Gainza installed a skimmer close to midnight on August 4, and an unidentified individual installed a camera the following morning. Both were removed by mid-afternoon that day, and Golden 1 reported that 71 customers visited the ATM during this time, none of whom reported any fraud.

The final incident took place on August 5 at an ATM in Citrus Heights. Gainza installed the skimmer at 12:06 a.m. and removed it at some point late that afternoon. During this time, 266 customers reportedly visited the ATM, though none reported fraud.

The scheme came to a halt later that day, when Gainza and Gabriele-Plage were stopped for a vehicle code violation, which led to a search of their hotel room and their arrest. All told, Golden 1 reported that 852 customers visited the ATMs while the skimmers were installed, including the 37 who reported fraud. Gabriele-Plage was only involved in the scheme for 754 of the visits, none of which resulted in fraud claims.

Gainza and Gabriele-Plage were charged by indictment with conspiracy to possess at least fifteen unauthorized access devices (count one), bank fraud (count two, Gainza only), access device fraud (count three), possession of

UNITED STATES V. GAINZA 7

device-making equipment 2 (count four, Gainza only), and aggravated identity theft (counts five and six). They pled guilty to all charges.

Over objection from the defense, the district court calculated the loss by multiplying the number of people that visited the ATMs by $500, which is the Sentencing Guidelines’ minimum loss amount for each stolen account number. Based on this calculation, the total loss amount was $426,000 for Gainza, and $377,000 for Gabriele-Plage. Both numbers fall within the same loss range, and therefore the court imposed the corresponding 12-level increase to each of their base offense levels in accordance with U.S.S.G. § 2B1.1(b)(1)(G). Gainza and Gabriele-Plage were sentenced, respectively, to 54 and 48 months.

ANALYSIS

For economic crimes, the Sentencing Guidelines provide for graduated increases to the base offense level depending on the amount of loss caused by the crime. U.S.S.G. § 2B1.1(b)(1). “[L]oss includes any unauthorized charges made with the . . . unauthorized access device and shall be not less than $500 per access device.” Id. § 2B1.1 cmt. n.3(F)(i). The term “access device” includes the information needed to access funds from a debit or credit card, such as the account number and the PIN. 18 U.S.C. § 1029(e)(1). The term “unauthorized access device” means an access device “that is lost, stolen, expired, revoked, canceled, or obtained with intent to defraud.” 18 U.S.C. § 1029(e)(3) (emphasis added); U.S.S.G. § 2B1.1 cmt. n.10(A). Stated

2 “Device-making equipment” is defined as “any equipment, mechanism, or impression designed or primarily used for making an access device or a counterfeit access device.” 18 U.S.C. § 1029(e)(6). simply, the Guidelines recommend that a minimum of $500 in loss be applied for each account number that Gainza and Gabriele-Plage obtained.

The pivotal question, then, is how many account numbers Gainza and Gabriele-Plage obtained. The answer is unlikely to be less than 37, the number of customers who reported fraud. Nor could it be more than 852, because only 852 people visited the ATMs while the skimmers were installed. The range of possibility is thus 37 to 852, and the question is what number the evidence supports.

The district court found that the evidence established the highest possible number—852—a finding that we review for clear error. United States v. Hornbuckle, 784 F.3d 549, 553 (9th Cir. 2015). Clear error exists only when the court is left with a “definite and firm conviction that a mistake has been committed.” United States v. Stargell, 738 F.3d 1018, 1024 (9th Cir. 2013) (quoting United States v. U.S. Gypsum Co., 333 U.S. 364, 395 (1948)).

Typical proof that a defendant obtained account numbers includes evidence that a defendant possessed cards or a document or digital file containing account numbers. See, e.g., United States v. Onyesoh, 674 F.3d 1157, 1158 (9th Cir. 2012) (defendant in possession of a spreadsheet containing 500 credit card numbers); United States v. Gaussiran, 2018 WL 6528006, at *3 (C.D. Cal. Dec. 10, 2018) (defendant in possession of sixty credit and debit cards). Another way of proving stolen accounts is through evidence that the defendant used account numbers. See, e.g., United States v. Alisuretove, 788 F.3d 1247, 1250 (10th Cir. 2015) (defendants made withdrawals from approximately 524 account numbers that had been obtained with a skimmer). And, of course, there may be other avenues of proof, such as expert testimony about the efficacy of a

UNITED STATES V. GAINZA 9

certain type of skimmer or the bank’s experience in similar digital heists. Such evidence might bridge the gap between proof of trying and proof of succeeding.

The government offered insufficient evidence that the defendants obtained or used 852 account numbers. And while the government showed how many people used the ATMs while the skimmers were installed, it did not provide any evidence of the skimmer success rate, either for these transactions or even for hypothetical transactions. Without this evidence, the record cannot support a finding that Gainza and Gabriele-Plage obtained information “that can be used to initiate a transfer of funds” from each ATM customer. 18 U.S.C. § 1029(e)(1). And while it is true that the sentencing judge “need only make a reasonable estimate of the loss,” U.S.S.G. § 2B1.1 cmt. n.3(C), that estimate must be based on facts, not conjecture. This is not to say that the estimate requires mathematical precision; rather, a “reasonable estimate” can be derived from a reasonable evaluation of the evidence.

Importantly, one example serves to affirmatively undermine the conclusion that Gainza and Gabriele-Plage obtained the maximum account information. Recall that at one point an ATM technician removed one of the skimmers, and in doing so prevented Gainza and Gabriele-Plage from obtaining any of the account information on that skimmer. Golden 1 reported that 228 customers visited the ATM before its removal, and though Gainza and Gabriele-Plage certainly did not obtain that account information, the district court included those accounts in the total counts. Given this oversight, and the independently fatal absence of sufficient evidence to support the district court’s calculations, the evidence cannot support the conclusion that Gainza and Gabriele-Plage obtained a respective total of 852 and 754 account numbers.

At Gabriele-Plage’s sentencing, the district court explained its calculation as follows:

Th[e] defendant repeated the scheme, placed the skimmer cameras, had access to device- making equipment and admitted to possessing banking card numbers from the scheme. All this evidence suggests that the defendant’s plan worked and he was able to obtain the account numbers and PINs exposed to the skimmers and cameras.

Nothing in the record supports the conclusion that either Gainza or Gabriele-Plage “admitted to possessing banking card numbers” other than the 37 account numbers for which fraud was reported. To its credit, the government does not suggest otherwise. At Gainza’s sentencing, the court’s explanation was more cursory:

There is sufficient evidence here to show and the Court will concede that even under the clear and convincing standard there is sufficient evidence here that the defendant obtained 852 active, usable account numbers ....

In support of its calculation, the district court cited the repetition of the scheme and possession of device-making equipment as evidence that Gainza and Gabriele-Plage succeeded in obtaining all account numbers. While it may be reasonable to assume they would not repeat the scheme if the success rate were zero, even that assumption falters under the “if at first you don’t succeed, try, try again”

UNITED STATES V. GAINZA 11

maxim. And it is certainly a huge logical leap to assume the scheme was 100 percent successful.

The government’s reasoning fares no better. The government argues that three facts support the conclusion that Gainza and Gabriele-Plage succeeded as to each ATM customer: (1) Gainza and Gabriele-Plage demonstrated that they were sophisticated in their efforts to obtain card numbers; (2) they traveled from Mexico to Sacramento on various occasions for the same scheme, suggesting that it was successful in various iterations; and (3) they had the equipment to make fake debit cards with the stolen account information, suggesting that they expected to be successful and had a plan to make use of the card information once obtained. These arguments essentially mirror the district court’s approach. But sophistication and travel hardly support perfection in execution of the scheme. Indeed, we know they were foiled by removal of the equipment. And the government’s suggestion that they expected to be successful is just that—an aspiration, not a confirmation.

At the end of the day, the record does not support the conclusion—even based on a reasonable estimate—that Gainza and Gabriele-Plage obtained 852 and 754 account numbers respectively. For this reason, the twelve-level increase to the base offense level was clear error.

VACATED AND REMANDED FOR

RESENTENCING.