United States v. Luis Ruiz Gainza

FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
UNITED STATES OF AMERICA, No. 19-10430
Plaintiff-Appellee,
D.C. No.
v. 2:17-cr-00225-
TLN-1
LUIS JOSE RUIZ GAINZA,
Defendant-Appellant.
UNITED STATES OF AMERICA, No. 20-10009
Plaintiff-Appellee,
D.C. No.
v. 2:17-cr-00225-
TLN-2
RICARDO GABRIELE-PLAGE,
Defendant-Appellant. OPINION
Appeal from the United States District Court
for the Eastern District of California
Troy L. Nunley, District Judge, Presiding
Argued and Submitted October 16, 2020
San Francisco, California
2 UNITED STATES V. GAINZA
Filed December 8, 2020
Before: M. Margaret McKeown and Jacqueline H.
Nguyen, Circuit Judges, and Eric N. Vitaliano, *
District Judge.
Opinion by Judge McKeown
SUMMARY **
Criminal Law
The panel vacated the sentences imposed on two
defendants who pleaded guilty to multiple offenses—
including conspiracy to possess unauthorized access
devices, access device fraud, and aggravated identity theft—
arising from the installation of cameras and skimmers at
ATMs near Sacramento, and remanded for resentencing.
In calculating the amount of loss caused by the scheme
under U.S.S.G. § 2B1.1(b)(1), the district court concluded
that the defendants obtained account information for each
person who visited the ATMs while the cameras and
skimmers were installed.
The panel held that the district court’s application of a
twelve-level increase to the base offense level under
*
The Honorable Eric N. Vitaliano, United States District Judge for
the Eastern District of New York, sitting by designation.
**
This summary constitutes no part of the opinion of the court. It
has been prepared by court staff for the convenience of the reader.
UNITED STATES V. GAINZA 3
U.S.S.G. § 2B1.1(b)(1)(G) was clear error because the
record does not support the conclusion—even based on a
reasonable estimate—that the defendants obtained 852 and
754 account numbers respectively. The panel wrote that
while the government showed how many people used the
ATMs while the skimmers were installed, it did not provide
any evidence of the skimmer success rate, without which the
record cannot support a finding that the defendants obtained
information “that can be used to initiate a transfer of funds”
from each ATM customer, as required by 18 U.S.C.
§ 1029(e)(1).
COUNSEL
Kresta Nora Daly (argued), Barth Daly LLP, Davis,
California, for Defendant-Appellant Ricardo Gabriele-
Plage.
David M. Porter (argued), Assistant Federal Defender;
Heather E. Williams, Federal Defender; Office of the
Federal Public Defender, Sacramento, California; for
Defendant-Appellant Luis Jose Ruiz Gainza.
Brian A. Fogerty (argued), Assistant United States Attorney;
Camil A. Skipper, Appellate Chief; McGregor W. Scott,
United States Attorney; United States Attorney’s Office,
Sacramento, California; for Plaintiff-Appellee.
4 UNITED STATES V. GAINZA
OPINION
McKEOWN, Circuit Judge:
The lesson in this case is that trying is not the same as
succeeding. Over the course of a few days in April and
August of 2017, hundreds of people used three Golden 1
Credit Union ATMs near Sacramento, California.
Unbeknownst to them, a hidden camera had been installed
to film their fingers as they entered their PINs. A
“skimmer”—a credit-card-sized tool that is placed into an
ATM to record the information of inserted cards—had also
been installed.
The responsible parties were Luis Ruiz Gainza and
Ricardo Gabriele-Plage, who pled guilty to all charges. The
issue on appeal, which bears only on sentencing, is how
much loss the scheme caused. In calculating the loss
amount, the district court concluded that Gainza and
Gabriele-Plage obtained account information for each
person who visited the ATMs while the cameras and
skimmers were installed. But while there is evidence that
Gainza and Gabriele-Plage hoped to obtain account
information for each ATM customer, there is insufficient
evidence that they succeeded in doing so. The district
court’s conclusion to the contrary was clear error, so we
promptly vacated the sentences and remanded the cases for
resentencing. 1
1
On October 20, 2020, we issued a brief order vacating the
sentences and remanding for expeditious resentencing. The order stated
that the mandate would issue forthwith, that the panel would retain
jurisdiction, and that this opinion would follow. On remand, the district
court provided the government with an opportunity to proffer additional
evidence, and the government declined to do so. The district court then
UNITED STATES V. GAINZA 5
BACKGROUND
The scheme began in April 2017. Gainza, acting without
the help of Gabriele-Plage, installed a skimmer and camera
at the Golden 1 ATM on Auburn Boulevard just after
midnight on April 6. He returned an hour later to check the
skimmer and adjust the camera. The next evening, three
unidentified individuals removed the skimmer and camera.
As part of its investigation, Golden 1 used surveillance video
to determine how long the skimmer was installed. Then,
using transaction records, Golden 1 determined that
109 customers used the ATM while the skimmer was
installed. Of those customers, 37 made fraud claims totaling
$20,781.60.
On August 2, Gainza and Gabriele-Plage together
installed a skimmer at the El Dorado Hills Golden 1 ATM.
Gabriele-Plage removed the skimmer 12 hours later, and
Golden 1 reported that 178 customers used the ATM in the
interim. Unlike the April incident, however, no ATM
customers reported any fraud.
They returned to the same location on August 3—
installing a skimmer shortly before 1:00 a.m., and later a
video camera. Both were removed at 7:00 a.m., and
Golden 1 reported that eleven customers used the ATM
during this time. Once again, no fraud claims were made.
The third attempt at this location went awry. The
skimmer was installed just after midnight on August 4, and
a camera was installed a few hours later. But before they
resentenced Gainza and Gabriele-Plage to time served. See United States
v. Gainza, No. 2:17-cr-225 (E.D. Cal., Oct. 29, 2020), ECF Nos. 128,
131–132.
6 UNITED STATES V. GAINZA
could remove the skimmer and camera, an ATM technician
discovered the skimmer and removed it. Golden 1 reported
that 228 customers used the ATM before the skimmer was
removed. No fraud claims were reported, and because the
skimmer was removed by the ATM technician, Gainza and
Gabriele-Plage did not obtain any account information.
After the skimmer was discovered at the El Dorado Hills
location, Gainza and Gabriele-Plage returned to the Auburn
Boulevard location. Gainza installed a skimmer close to
midnight on August 4, and an unidentified individual
installed a camera the following morning. Both were
removed by mid-afternoon that day, and Golden 1 reported
that 71 customers visited the ATM during this time, none of
whom reported any fraud.
The final incident took place on August 5 at an ATM in
Citrus Heights. Gainza installed the skimmer at 12:06 a.m.
and removed it at some point late that afternoon. During this
time, 266 customers reportedly visited the ATM, though
none reported fraud.
The scheme came to a halt later that day, when Gainza
and Gabriele-Plage were stopped for a vehicle code
violation, which led to a search of their hotel room and their
arrest. All told, Golden 1 reported that 852 customers visited
the ATMs while the skimmers were installed, including the
37 who reported fraud. Gabriele-Plage was only involved in
the scheme for 754 of the visits, none of which resulted in
fraud claims.
Gainza and Gabriele-Plage were charged by indictment
with conspiracy to possess at least fifteen unauthorized
access devices (count one), bank fraud (count two, Gainza
only), access device fraud (count three), possession of
UNITED STATES V. GAINZA 7
device-making equipment 2 (count four, Gainza only), and
aggravated identity theft (counts five and six). They pled
guilty to all charges.
Over objection from the defense, the district court
calculated the loss by multiplying the number of people that
visited the ATMs by $500, which is the Sentencing
Guidelines’ minimum loss amount for each stolen account
number. Based on this calculation, the total loss amount was
$426,000 for Gainza, and $377,000 for Gabriele-Plage.
Both numbers fall within the same loss range, and therefore
the court imposed the corresponding 12-level increase to
each of their base offense levels in accordance with U.S.S.G.
§ 2B1.1(b)(1)(G). Gainza and Gabriele-Plage were
sentenced, respectively, to 54 and 48 months.
ANALYSIS
For economic crimes, the Sentencing Guidelines provide
for graduated increases to the base offense level depending
on the amount of loss caused by the crime. U.S.S.G.
§ 2B1.1(b)(1). “[L]oss includes any unauthorized charges
made with the . . . unauthorized access device and shall be
not less than $500 per access device.” Id. § 2B1.1 cmt.
n.3(F)(i). The term “access device” includes the information
needed to access funds from a debit or credit card, such as
the account number and the PIN. 18 U.S.C. § 1029(e)(1).
The term “unauthorized access device” means an access
device “that is lost, stolen, expired, revoked, canceled, or
obtained with intent to defraud.” 18 U.S.C. § 1029(e)(3)
(emphasis added); U.S.S.G. § 2B1.1 cmt. n.10(A). Stated
2
“Device-making equipment” is defined as “any equipment,
mechanism, or impression designed or primarily used for making an
access device or a counterfeit access device.” 18 U.S.C. § 1029(e)(6).
8 UNITED STATES V. GAINZA
simply, the Guidelines recommend that a minimum of $500
in loss be applied for each account number that Gainza and
Gabriele-Plage obtained.
The pivotal question, then, is how many account
numbers Gainza and Gabriele-Plage obtained. The answer
is unlikely to be less than 37, the number of customers who
reported fraud. Nor could it be more than 852, because only
852 people visited the ATMs while the skimmers were
installed. The range of possibility is thus 37 to 852, and the
question is what number the evidence supports.
The district court found that the evidence established the
highest possible number—852—a finding that we review for
clear error. United States v. Hornbuckle, 784 F.3d 549, 553
(9th Cir. 2015). Clear error exists only when the court is left
with a “definite and firm conviction that a mistake has been
committed.” United States v. Stargell, 738 F.3d 1018, 1024
(9th Cir. 2013) (quoting United States v. U.S. Gypsum Co.,
333 U.S. 364, 395 (1948)).
Typical proof that a defendant obtained account numbers
includes evidence that a defendant possessed cards or a
document or digital file containing account numbers. See,
e.g., United States v. Onyesoh, 674 F.3d 1157, 1158 (9th Cir.
2012) (defendant in possession of a spreadsheet containing
500 credit card numbers); United States v. Gaussiran, 2018
WL 6528006, at *3 (C.D. Cal. Dec. 10, 2018) (defendant in
possession of sixty credit and debit cards). Another way of
proving stolen accounts is through evidence that the
defendant used account numbers. See, e.g., United States v.
Alisuretove, 788 F.3d 1247, 1250 (10th Cir. 2015)
(defendants made withdrawals from approximately
524 account numbers that had been obtained with a
skimmer). And, of course, there may be other avenues of
proof, such as expert testimony about the efficacy of a
UNITED STATES V. GAINZA 9
certain type of skimmer or the bank’s experience in similar
digital heists. Such evidence might bridge the gap between
proof of trying and proof of succeeding.
The government offered insufficient evidence that the
defendants obtained or used 852 account numbers. And
while the government showed how many people used the
ATMs while the skimmers were installed, it did not provide
any evidence of the skimmer success rate, either for these
transactions or even for hypothetical transactions. Without
this evidence, the record cannot support a finding that
Gainza and Gabriele-Plage obtained information “that can
be used to initiate a transfer of funds” from each ATM
customer. 18 U.S.C. § 1029(e)(1). And while it is true that
the sentencing judge “need only make a reasonable estimate
of the loss,” U.S.S.G. § 2B1.1 cmt. n.3(C), that estimate
must be based on facts, not conjecture. This is not to say that
the estimate requires mathematical precision; rather, a
“reasonable estimate” can be derived from a reasonable
evaluation of the evidence.
Importantly, one example serves to affirmatively
undermine the conclusion that Gainza and Gabriele-Plage
obtained the maximum account information. Recall that at
one point an ATM technician removed one of the skimmers,
and in doing so prevented Gainza and Gabriele-Plage from
obtaining any of the account information on that skimmer.
Golden 1 reported that 228 customers visited the ATM
before its removal, and though Gainza and Gabriele-Plage
certainly did not obtain that account information, the district
court included those accounts in the total counts. Given this
oversight, and the independently fatal absence of sufficient
evidence to support the district court’s calculations, the
evidence cannot support the conclusion that Gainza and
10 UNITED STATES V. GAINZA
Gabriele-Plage obtained a respective total of 852 and
754 account numbers.
At Gabriele-Plage’s sentencing, the district court
explained its calculation as follows:
Th[e] defendant repeated the scheme, placed
the skimmer cameras, had access to device-
making equipment and admitted to
possessing banking card numbers from the
scheme. All this evidence suggests that the
defendant’s plan worked and he was able to
obtain the account numbers and PINs
exposed to the skimmers and cameras.
Nothing in the record supports the conclusion that either
Gainza or Gabriele-Plage “admitted to possessing banking
card numbers” other than the 37 account numbers for which
fraud was reported. To its credit, the government does not
suggest otherwise. At Gainza’s sentencing, the court’s
explanation was more cursory:
There is sufficient evidence here to show and
the Court will concede that even under the
clear and convincing standard there is
sufficient evidence here that the defendant
obtained 852 active, usable account numbers
....
In support of its calculation, the district court cited the
repetition of the scheme and possession of device-making
equipment as evidence that Gainza and Gabriele-Plage
succeeded in obtaining all account numbers. While it may
be reasonable to assume they would not repeat the scheme if
the success rate were zero, even that assumption falters
under the “if at first you don’t succeed, try, try again”
UNITED STATES V. GAINZA 11
maxim. And it is certainly a huge logical leap to assume the
scheme was 100 percent successful.
The government’s reasoning fares no better. The
government argues that three facts support the conclusion
that Gainza and Gabriele-Plage succeeded as to each ATM
customer: (1) Gainza and Gabriele-Plage demonstrated that
they were sophisticated in their efforts to obtain card
numbers; (2) they traveled from Mexico to Sacramento on
various occasions for the same scheme, suggesting that it
was successful in various iterations; and (3) they had the
equipment to make fake debit cards with the stolen account
information, suggesting that they expected to be successful
and had a plan to make use of the card information once
obtained. These arguments essentially mirror the district
court’s approach. But sophistication and travel hardly
support perfection in execution of the scheme. Indeed, we
know they were foiled by removal of the equipment. And
the government’s suggestion that they expected to be
successful is just that—an aspiration, not a confirmation.
At the end of the day, the record does not support the
conclusion—even based on a reasonable estimate—that
Gainza and Gabriele-Plage obtained 852 and 754 account
numbers respectively. For this reason, the twelve-level
increase to the base offense level was clear error.
VACATED AND REMANDED FOR
RESENTENCING.