Appeal from the United States District Court for the Southern District of Alabama D.C. Docket No. 1:22-cr-00047-KD-MU-3Page 2 Before JORDAN, NEWSOM, and BRASHER, Circuit Judges.

JORDAN, Circuit Judge:

A grand jury indicted Timothy Buchanan and his two alleged co-conspirators, Jaleeshia Robinson and Tyre Crawford, on various charges: one count of conspiracy to commit bank fraud in violation of 18 U.S.C. § 1349 (Count I); one count of possession of five or more identification documents with intent to use or transfer in violation of 18 U.S.C. §§ 1028(a)(3), (b)(2)(B), and 2 (Count II); one count of possession of counterfeited or forged securities in violation of 18 U.S.C. §§ 513(a) and 2 (Count III); two counts of aggravated identity theft in violation of 18 U.S.C. §§ 1028A(a)(1) and 2 (Counts IV and V); and one count of possession of stolen mail in violation of 18 U.S.C. §§ 1708 and 2 (Count VI). As noted, each of the substantive charges contained an aiding and abetting allegation pursuant to 18 U.S.C. § 2.

The jury acquitted Mr. Buchanan on Count IV and convicted him on the remaining charges. The district court sentenced him to a term of imprisonment of 116 months.

On appeal, Mr. Buchanan challenges his convictions on Counts II, III, V, and VI, as well as his sentence. First, he argues that the government presented insufficient evidence on Counts II and III to establish that he had actual or constructive possession of the stolen checks or identification cards. Second, he asserts that his conviction on Count V should be reversed under Dubin v. United States , 599 U.S. 110 (2023), because the use of a person’s means of identification was not the crux of the predicate offense on Count Page 3II. Third, he maintains that the government presented insufficient evidence on Count VI showing that he participated in the theft of checks or that he had actual or constructive possession of the stolen checks. Fourth, he contends that the district court erred in calculating his sentence and in setting the amount of restitution.

After reviewing the briefs and the record, and with the benefit of oral argument, we affirm Mr. Buchanan’s convictions but set aside the sentence because the district court erred in applying the sophisticated means enhancement and in calculating the amount of restitution.

On February 23, 2022, Baldwin County officers stopped a vehicle suspected of violating Alabama law due to extremely dark and bubbling window tints. Inside the vehicle, the officers found Ms. Robinson in the driver’s seat, Mr. Crawford in the front passenger’s seat, and Mr. Buchanan in the back seat.

The officers saw in plain sight a cigarette pack with several burnt cigarettes that they inferred were “marijuana roaches or partially smoked marijuana joints.' The officers briefly interviewed Ms. Robinson separately . She told them that Mr. Crawford was her boyfriend and that Mr. Buchanan “was a friend, coworker, of . . . Mr. Crawford, and that they had known each other for some time.” The officers then detained Ms. Robinson, Mr. Crawford, and Mr. Buchanan, and searched the vehicle.

Page 4In the front passenger seat, the officers found a white envelope containing multiple identification cards, credit cards, and checks. Some of those identification cards and credit cards were forged, while others were believed to be real and/or stolen. The envelope also contained seven checks, seven credit cards, and six identification cards that depicted 'a late twenties to early thirties white male with a short haircut.”

The trunk of the vehicle contained the occupants’ personal belongings, an ink printer, a check encoding machine, a laptop computer and mouse, hundreds of sheets of blank check paper, and a magnetic lockbox. When asked for the code of the lockbox, Mr. Crawford said that he did not know the combination but permitted the officers to break it open. Inside the lockbox the officers found 35 stolen checks from various businesses and individuals totaling approximately $317,000.

The officers spoke to Mr. Buchanan after reading him his rights pursuant to Miranda v. Arizona , 384 U.S. 436 (1966). Mr. Buchanan told the officers that he met Mr. Crawford while riding his bicycle on a street in Tampa, Florida, and Mr. Crawford had offered him a job. Mr. Buchanan claimed that he did not know at that time exactly what the work entailed, but that it had “something to do with checks,” and that “he thought he would . . . just be cashing checks because [Mr. Crawford and Ms. Robinson] needed a white boy.” Mr. Buchanan also admitted to cashing fraudulent checks at banks using stolen and forged identification cards 'loosely depict[ing]' him. The officers found heroin and a microSD card on Page 5Mr. Buchanan. But they did not find any identification cards or checks, real or fraudulent, on him or in his bag.

Following the search of the vehicle, the officers arrested Ms. Robinson, Mr. Crawford, and Mr. Buchanan for possessing stolen checks and equipment to produce fraudulent checks. Mr. Buchanan was interviewed by law enforcement and provided a written statement.

Mr. Buchanan again admitted to cashing fraudulent checks. He explained that he met Mr. Crawford while biking in Tampa, and accepted a job with him cashing checks. Mr. Crawford would give Mr. Buchanan a single check and a single identification card to cash the check at a bank, and Mr. Buchanan would put superglue on his fingers to ensure that his fingerprints were not transferred onto the checks. Mr. Buchanan would return the check (if unsuccessful) and the identification card to Mr. Crawford after each job. Mr. Buchanan received “roughly $100 per [$]1000” from cashing a check. Mr. Buchanan stated that he participated in three trips with Mr. Crawford without providing the dates for those trips, and described an instance in which he tried to cash a check but left because he “got spooked” that a bank employee would catch him and call the police.

Mr. Buchanan pled not guilty to the charges in the indictment and proceeded to a jury trial. During the trial, the jury heard testimony from various witnesses regarding the conspiracy, the stop, search, and arrest, and the losses caused by the scheme.

Page 6The jury heard testimony from the officers who conducted the traffic stop and search of the vehicle, interviewed Mr. Buchanan and his co-defendants, and searched their phones. They recounted the day of the traffic stop, including what their search of the vehicle revealed and the substance of Mr. Buchanan’s interview and written statement prior to and following the arrest.

The officers explained how data from Mr. Crawford’s laptop, the defendants’ phones, and Mr. Buchanan’s microSD was extracted and testified to the content of the extracted data. For example, Mr. Crawford's laptop contained images of checks that matched the stolen checks in the vehicle. Ms. Robinson’s phone search history revealed searches for Daphne and Mobile, Alabama, as well as for banks in the area on the day of the traffic stop. Mr. Buchanan’s phone call and text logs revealed that Mr. Buchanan and Mr. Crawford were in constant communication, both through phone calls and text messages, regarding jobs and trips to cash fraudulent checks. It also showed that Mr. Buchanan was in regular communication with Mr. Crawford in the days before the traffic stop. Media extracted from Mr. Buchanan's microSD card contained photographs of credit cards, identification cards, social security cards and paperwork, bills, and a piece of paper with handwritten names and addresses, none of which were in Mr. Buchanan’s name.

The government also presented testimony and evidence regarding Mr. Buchanan’s mobile phone call log and text messages Page 7with Ms. Robinson and Mr. Crawford. The text message log showed that Mr. Buchanan first texted Mr. Crawford on February 1, 2022, to inform him of his new phone number. Mr. Buchanan remained in constant contact with Ms. Robinson and Mr. Crawford, though they would only contact Mr. Buchanan to participate in or to coordinate travel and pick-up for an upcoming job. For example, after Mr. Buchanan gave Mr. Crawford his new number, the two immediately began coordinating a trip to cash fraudulent checks. There were similar communications between Mr. Buchanan, Ms. Robinson, and Mr. Crawford to coordinate pick up and jobs in the days leading up to the traffic stop.

The jury also heard testimony from Ms. Robinson, who signed a plea agreement to cooperate with the government. She testified as to the check-cashing scheme and Mr. Buchanan's role in it.

Ms. Robinson and Mr. Crawford met Mr. Buchanan in the beginning of February of 2022 on a street in Tampa, while he was riding his bicycle. They flagged him down, asked him if he wanted to make some money, and explained the scheme to cash fraudulent checks. According to Ms. Robinson, Mr. Buchanan agreed without hesitation. She explained that Mr. Buchanan “was just a worker” with “one job”—to “[g]o in the bank and cash the check[.]” She also testified that he was not in charge of the scheme to cash checks.

Page 8On the day of the arrest, Ms. Robinson, Mr. Crawford, and Mr. Buchanan were returning to Tampa from Mobile, where they had travelled to cash fraudulent checks. The vehicle they traveled in was rented by Ms. Robinson in her father’s name. They spent approximately three days in the Mobile County and Baldwin County areas. Ms. Robinson and Mr. Crawford stayed in a separate hotel from Mr. Buchanan and did not tell him where they were staying 'in case he were to get into any type of trouble . . . he wouldn’t be able to tell the authorities what hotel [they] were staying at.' Specifically , they were concerned he would get into trouble because they believed he was using drugs. In their hotel room, Ms. Robinson and Mr. Crawford identified banks to go to in the area and put together the fraudulent checks they would try to negotiate. Mr. Buchanan never assisted with the creation or construction of the fraudulent checks.

Ms. Robinson explained the use of each of the items the officers found during the search of the vehicle. She said that the printer “was used for printing checks,” the magnetic lockbox was used to store checks, the check encoder was used “[t]o put the routing and account numbers on the bottom of the checks,” the laptop was used to “photoshop checks” and was used “[q]uite often,” and the blank check paper (purchased online) was used to make fraudulent checks. Ms. Robinson confirmed that only Mr. Crawford knew the code to the magnetic lockbox and the password to the laptop, and that she and Mr. Buchanan never used the laptop.

Page 9In addition, Ms. Robinson described the process for stealing, making, and cashing fraudulent checks. She and Mr. Crawford would identify industrial sites to steal checks from by searching online and on maps or locating areas while driving. They would typically steal checks on Saturday nights between the hours of 2:00 A.M. and 4:00 A.M. because there were fewer people out at that time. They would not bring Mr. Buchanan for fear of suspicion, but would sometimes tell him that they were going to “go get some more work.' Mr. Buchanan offered to help steal checks, but Mr. Crawford “wouldn’t let him because he didn’t want him to know exactly everything [he and Ms. Robinson] were doing and the places [they] were going.'

After taking checks from mailboxes, Ms. Robinson and Mr. Crawford would scan the stolen checks into the laptop and use a computer program to duplicate them onto blank checks. They would then alter the names and addresses on the fraudulent checks to match the identification cards that would be used by Mr. Buchanan at the bank. Those identification cards contained pictures of individuals that most resembled Mr. Buchanan. After applying a fresh coat of ink to the signature on the fraudulent check, Ms. Robinson and Mr. Crawford would match the check to the appropriate identification card and sort them in the order of the banks they would visit. Mr. Crawford stored the fraudulent checks in the metal lockbox. This process was briefly explained to Mr. Buchanan, who stated that “he knew exactly how to do this” because he had attempted to make and cash a fraudulent check in the past.

Page 10Ms. Robinson and Mr. Crawford would pick Mr. Buchanan up from his hotel in the morning before going to cash the fraudulent checks. Mr. Crawford would provide Mr. Buchanan with one check, one identification card, and a debit or charge card as a second form of identification. Mr. Buchanan would apply superglue to his fingertips before entering the bank 'because sometimes [the bank] ask[ed] [Mr. Buchanan] to put a thumbprint.”

While Mr. Buchanan attempted to cash a fraudulent check, Ms. Robinson and Mr. Crawford remained in the car and listened on a phone call with Mr. Buchanan to his interaction with the bank teller. Ms. Robinson and Mr. Crawford would instruct Mr. Buchanan if they “heard something that just didn’t sound right . . . from the bank manager or something” because “when you go inside a bank to cash a check, it really doesn’t take long; they don’t tell you to wait.” Mr. Buchanan would not cash a fraudulent check if he did not feel comfortable or the bank 'gave him an awkward feeling.” Ms. Robinson estimated that at least ten banks did not negotiate a check from Mr. Buchanan.

If Mr. Buchanan was successful, Ms. Robinson and Mr. Crawford would pay him ten percent of the check amount. Once the job was completed, Mr. Buchanan would immediately return the money and identification cards to Mr. Crawford unless he was reusing the identification cards for another job.

3

The government also elicited testimony from victims of the scheme. The victims-some of whom were the basis for the Page 11aggravated identity theft charges—were asked to identify their stolen checks and the signatures on them. For example, Lori Mondello identified her signature on her stolen check and her full name at the top of the check. Michelle Boyd similarly identified the signature of M. James Gorrie (“M.J.G.”), the chief executive officer of the company she worked for.

Each victim explained the purpose for issuing the stolen check, where she placed the check, her response to learning the check had been stolen, and the impact the scheme had on her business or personal affairs. For example, one victim testified that she was required to reissue checks she sent to vendors for the construction of her home and had to have a new account created for the construction loan. Another victim explained that her business practice for responding to stolen checks included immediately voiding the check, contacting the vendor to find out if the voided check had been received, dealing with the bank to stop payment of the check, and reissuing the check. A third victim reported being assessed late fees because of the delayed payments.

Mr. Buchanan moved for a judgment of acquittal on all charges after the government rested its case. As to each of the charges, he argued that the evidence presented at trial was insufficient to prove guilt. The district court denied the motion for judgment of acquittal.

The jury found Mr. Buchanan guilty on all charges except for the aggravated identity theft charge in Count IV . Mr. BuchananPage 12 filed a post-trial motion for judgment of acquittal and moved for a new trial in the alternative. The district court denied the motions.

The probation officer calculated Mr. Buchanan's total offense level under the Sentencing Guidelines to be 25, which consisted of a base offense level of 7 and enhancements of 12 levels for the amount of intended loss, 2 levels for more than 10 victims, 2 levels for sophisticated means, and 2 levels for use of a device or authentication-type machine or feature. The probation officer also determined that Mr. Buchanan had 14 criminal history points, establishing a criminal history category of VI.

At the sentencing hearing, Mr. Buchanan raised several objections to the presentence investigation report, the calculation of his total offense level, and the amount of restitution. We discuss some of these objections later.

The district court sentenced Mr. Buchanan to a term of imprisonment of 116 months. That term consisted of 92 months as to Counts I and III, and 60 months as to Counts II and VI, to be served concurrently, and 24 months as to Count V, to be served consecutively. The court also sentenced Mr. Buchanan to a term of supervised release of 5 years as to Count I, a term of 3 years as to Counts II, III, and VI, and a term of 1 year as to Count V, all to run concurrently. The court ordered Mr. Buchanan to pay restitution in the amount of $24,701.20.

Page 13Mr. Buchanan challenges the sufficiency of the evidence as to four of his convictions. He argues that there was insufficient evidence to establish that he was in possession of the identification cards and checks found in the vehicle during the stop, to prove that he committed aggravated identity theft, or to show that he possessed stolen mail.

We review a challenge to the sufficiency of the evidence de novo . See United States v. Sammour , 816 F.3d 1328, 1335 (11th Cir. 2016); United States v. Klopf , 423 F.3d 1228, 1236 (11th Cir. 2005). We view the evidence in the light most favorable to the government and make all inferences and credibility determinations in favor of the jury verdict. See United States v. Lee , 427 F.3d 881, 887 (11th Cir. 2005). We will affirm a conviction “[i]f there is any reasonable construction of the evidence that would allow the jury to find the defendant[ ] guilty beyond a reasonable doubt[.]” Id. See also United States v. Bacon , 598 F.3d 772, 775 (11th Cir. 2010) (“[T]he question is whether reasonable minds could have found guilt beyond a reasonable doubt, not whether reasonable minds must have found guilt beyond a reasonable doubt.”) (quoting United States v. Ellisor , 522 F.3d 1255, 1271 (11th Cir. 2008)).

We first consider Counts II, III, and VI, which charged Mr. Buchanan respectively with the unlawful possession of five or more identification cards, possession of counterfeited or forged securities, and possession of stolen mail. As noted, Mr. Buchanan Page 14was alternatively charged in Counts II, III, and VI with aiding and abetting under 18 U.S.C. § 2. To successfully establish guilt under an aiding and abetting theory, the government must prove that “(1) the substantive offense was committed by someone; (2) the defendant committed an act which contributed to and furthered the offense; and (3) the defendant intended to aid in its commission.' United States v. Camacho , 233 F.3d 1308, 1317 (11th Cir. 2000). The requisite intent is satisfied where the defendant “actively participates in a criminal venture with full knowledge of the circumstances.' Rosemond v. United States , 572 U.S. 65, 77 (2014). Moreover, an affirmative act 'comprehends all assistance rendered by words, acts, encouragement, support, or presence.” Id. at 73 (citation modified). “A defendant can be properly convicted of aiding and abetting ‘even when he has not personally committed all the acts constituting the elements of the substantive crime aided.'' United States v. Sosa , 777 F.3d 1279, 1293 (11th Cir. 2015) (quoting United States Hornaday , 392 F.3d 1306, 1311 (11th Cir. 2004)).

To prove its aiding and abetting theory with respect to Counts II, III, and VI, the government was required to establish, respectively, that (1) Mr. Crawford and/or Ms. Robinson violated 18 U.S.C. §§ 1028(a)(3), 1028(b)(2)(B), and 1708, (2) Mr. Buchanan affirmatively contributed to the furtherance of each of those offenses, and (3) Mr. Buchanan intended to aid in the commission of each of those offenses.

Page 15The jury convicted Mr. Buchanan on Count II of possession of five or more identification documents with intent to use or transfer in violation of 18 U.S.C. §§ 1028(a)(3), 1028(b)(2)(B), and 2. The jury convicted him on Count III of possession of counterfeited or forged securities in violation of 18 U.S.C. §§ 513(a) and 2. Because Mr. Buchanan raises similar arguments for both charges, we address Counts II and III together.

Mr. Buchanan argues that the government failed to present sufficient evidence to show that he had actual or constructive possession of either the identification cards or the counterfeit checks found in the vehicle. He asserts that he never had actual possession because neither the cards nor the checks were found on his person or in his luggage. And he maintains that he did not have constructive possession because Ms. Robinson and Mr. Crawford maintained full control of the cards and checks and were generally in charge of the scheme. We disagree.

Under § 1028(a)(3), it is unlawful to “knowingly possess[ ] with intent to use unlawfully or transfer unlawfully five or more identification documents (other than those issued lawfully for the use of the possessor), authentication features, or false identification documents . . . .” To obtain a conviction, the government must prove beyond a reasonable doubt that the defendant (1) “knowingly possessed five or more false identification documents,' (2) “had the willful intent to transfer the false identification documents unlawfully,' and (3) that the 'possession of the falsePage 16 identification documents was in or affecting interstate commerce.” Klopf , 423 F.3d at 1236 (quoting United States v. Alejandro , 118 F.3d 1518, 1521 (11th Cir. 1997)).

The other relevant provision, § 513(a), makes it a criminal offense to “make[ ], utter[ ] or possess[ ] a counterfeited security of a State or a political subdivision thereof or of an organization, or . . . make[ ], utter[ ] or possess[ ] a forged security of a State or political subdivision thereof or of an organization, with intent to deceive another person, organization, or government . . . .” To secure a conviction, the government must prove beyond a reasonable doubt that the defendant “(1) made, uttered, or possessed (2) a counterfeit security (3) of an organization (4) with intent to deceive another person, organization, or government.' United States v. Chappell , 6 F.3d 1095, 1098 (5th Cir. 1993).

The heart of Mr. Buchanan’s challenge to Counts II and III is that he was never in actual or constructive possession of the identification cards and counterfeit checks found in the vehicle. In his view of the record, Mr. Crawford and Ms. Robinson were in sole possession of these items and controlled his access to them. Be that as it may, Mr. Buchanan aided and abetted the possession by Mr. Crawford and/or Ms. Robinson.

“Actual possession exists when a person has direct physical control over a thing.” United States v. Ochoa , 941 F.3d 1074, 1104 (11th Cir. 2019) (quoting Henderson v. United States , 575 U.S. 622, 626 (2015)). Constructive possession, on the other hand, occurs when a person “has knowledge of the thing possessed coupled with Page 17the ability to maintain control over it or reduce it to his physical possession, even though he does not have actual personal dominion.” United States v. Baldwin , 774 F.3d 711, 722 (11th Cir. 2014) (quoting Aqua Log, Inc. v. Georgia, 594 F.3d 1330, 1336 (11th Cir. 2010)). Constructive possession also occurs when a person exercises “ownership, dominion, or control over the contraband itself or dominion or control over the premises or the vehicle in which the contraband [is] concealed.' Id. (quoting Aqua Log, Inc. , 594 F.3d at 1336–37).

A reasonable jury could find on this record that Mr. Buchanan aided and abetted Mr. Crawford and/or Ms. Robinson in possessing the identification cards and counterfeit checks found in the vehicle. The government was required to prove that Mr. Buchanan took affirmative steps to aid in possessing the identification cards and counterfeit checks and intended to do so. See Camacho , 233 F.3d at 1317. There was ample evidence of Mr. Buchanan’s intent. And Mr. Buchanan’s role in the scheme as the check-casher was sufficient to establish aiding and abetting liability. See United States v. Kelley , 559 F.2d 399, 400 (5th Cir. 1977) (holding that the defendant aided and abetted the possession of stolen checks by a co-conspirator by having false identification cards created to cash the checks).

The convictions on Counts II and III stand.

We next assess the conviction on Count VI for possession of stolen mail in violation of 18 U.S.C. §§ 1708 and 2. Mr. Buchanan Page 18argues that the government failed to present sufficient evidence that he had actual or constructive possession of the stolen checks or that he participated in stealing checks from the mail. In his view, the evidence showed that Ms. Robinson and Mr. Buchanan stole the checks from the mail and maintained possession of them.

As relevant here, § 1708 provides as follows: Whoever steals, takes, or abstracts, or by fraud or deception obtains, or attempts so to obtain, from or out of any mail, post office, or station thereof, letter box, mail receptacle, or any mail route or other authorized depository for mail matter, or from a letter or mail carrier, any letter, postal card, package, bag, or mail, or abstracts or removes from any such letter, package, bag, or mail, any article or thing contained therein, or secretes, embezzles, or destroys any such letter, postal card, package, bag, or mail, or any article or thing contained therein . . . .

The statute also criminalizes the unlawful “possession [of] . . . mail . . . which has been so stolen . . . .' Id. '[I]n order to sustain a conviction under [§] 1708, the government must prove that the defendant [1] possessed material stolen from the mail, [2] knew that it had been stolen, and [3] had the specific intent to possess the material unlawfully.” United States v. Mendez , 117 F.3d 480, 487 (11th Cir. 1997) (citation and internal quotation marks omitted).

As its text makes clear, § 1708 not only criminalizes “steal[ing], tak[ing], or abstract[ing]” mail, but also makes punishable the “possession [of] . . . mail . . . which has been so stolen . . . .”Page 19 See Singleton v. United States , 294 F. 890, 892 (5th Cir. 1923) (prosecution for possession of money knowing it was stolen from the mail was not barred by prior acquittal on charge of stealing the same money from the mail: “He might well be innocent of the theft, and guilty of the criminal possession.”). Although Mr. Buchanan argues that he did not personally steal checks from the mail, the record establishes that he aided and abetted Mr. Crawford and Ms. Robinson in stealing and possessing the checks found in the lockbox.

The government was required to prove that Mr. Buchanan took affirmative steps to aid in possessing stolen mail and intended to do so. See Camacho , 233 F.3d at 1317. Mr. Buchanan remained in constant contact with Mr. Crawford about the scheme, but Ms. Robinson testified that Mr. Buchanan also offered to help steal checks. Viewed in the light most favorable to the government, a reasonable jury could find that Mr. Buchanan encouraged Mr. Crawford and Ms. Robinson to steal mail. The jury could also find that Mr. Buchanan had the requisite intent because he 'actively participate[d] in a criminal venture with full knowledge of the circumstances.' Rosemond , 572 U.S. at 77.

Moreover, we find no merit in Mr. Buchanan’s argument that he did not aid or abet the possession of stolen mail because he joined the scheme after Mr. Crawford stole the mail. Possession under § 1708 is a continuing offense while the defendant has the stolen item, and is not temporally limited to when the item was stolen. See United States v. Maher , 955 F.3d 880, 886 (11th Cir. 2020)Page 20 (“The text of [18 U.S.C. §] 641 makes clear that we must treat [the defendant’s] offense of retaining government property as a continuing offense. . . . The essence of retention is possession, which itself is a ‘continuing offense’ because the crime is not complete until the possessor parts with the item.”).

In sum, Mr. Buchanan’s conviction on Count VI was supported by sufficient evidence.

We next take up Mr. Buchanan’s attack on the Count V conviction for aggravated identity theft in violation of 18 U.S.C. §§ 1028A(a)(1) and 2. Relying on Dubin v. United States , 599 U.S. 110 (2023), Mr. Buchanan argues that possession or use of the signature of “M.J.G.” was not the “crux” of the predicate offense under 18 U.S.C. § 1028(a)(3) that was relied on for the aggravated identity theft charge. The government responds that identity theft was at the heart of the scheme to negotiate fraudulent checks.

Before considering Mr. Buchanan's arguments, we must first determine whether our review is plenary or for plain error. The government maintains that Mr. Buchanan’s Dubin argument should be reviewed for plain error because he failed to raise a similar sufficiency-of-the-evidence objection in the district court. Mr. Buchanan does not respond to this contention.

Normally, '[w]e subject a sufficiency of evidence challenge, a question of law, to de novo review.” United States v. Hunerlach , 197Page 21 F.3d 1059, 1068 (11th Cir. 1999). But “[w]hen a defendant raises specific challenges to the sufficiency of the evidence in the district court, but not the specific challenge he tries to raise on appeal, we review his argument for plain error.” United States v. Baston , 818 F.3d 651, 664 (11th Cir. 2016). “The plain-error standard applies even if . . . there were no legal grounds for challenging [at the time] . . . , but such legal grounds have since arisen due to a new rule of law arising between the time of conviction and the time of appeal.” United States v. Gladden , 78 F .4th 1232, 1245 (11th Cir. 2023) (citation and internal quotation marks omitted). See also United States v . Duldulao , 87 F .4th 1239, 1256 (11th Cir. 2023) ('[S]ubject to plain error review[ ], we allow an appellant to raise new arguments based on intervening precedent.').

Because Mr. Buchanan moved for a judgment of acquittal on different grounds than the one raised here, we review his argument based on Dubin for plain error. See Baston , 818 F .3d at 664. See also United States v. Al Jaberi , 97 F .4th 1310, 1323 (11th Cir. 2024) (' Although [the defendant] moved for a judgment of acquittal, he did so on different grounds than those raised here. We therefore review his arguments here for plain error.'). 'We find plain error when (1) an error has occurred, (2) the error was plain, and (3) it affected the defendant's substantial rights, and if those prongs are met, we then have discretion to correct the error if it (4) seriously affected the fairness of the judicial proceedings.' United States v.

Page 2222 22-14195

Malone , 51 F .4th 1311, 1319 (11th Cir. 2022) (citing Johnson v. United States , 520 U.S. 461, 466-67 (1997)).¹

Count V of the indictment charged Mr. Buchanan with knowingly transferring, possessing, and using, a means of identification-specifically identified as a check with the signature of “M.J.G.”—“during and in relation” to the Count II charge—possessing five or more identification documents with intent to unlawfully use or transfer in violation of § 1028(a)(3). Simply put, the indictment charged Mr. Buchanan with aggravated identity theft for possessing a fraudulent check with M.J.G.’s signature in conjunction with possessing an identification document that he intended to unlawfully use or transfer in a manner that would affect interstate commerce.

Under § 1028A(a)(1), it is unlawful to “knowingly transfer[ ], possess[ ], or use[ ], without lawful authority, a means of identification of another person' 'during and in relation to' certain Page 23enumerated felonies. A violation of § 1028(a)(3) is one of the enumerated crimes that may serve as an underlying offense. See id. § 1028A(c)(4) (defining enumerated felony violations to include “any offense that is a felony violation of . . . any provision contained in [§ 1028] (relating to fraud and false statements), other than [§ 1028A] or [§] 1028(a)(7)'). To obtain a conviction under § 1028A(a)(1), the government must prove beyond a reasonable doubt that the defendant “(1) knowingly transfer[red], possesse[d], or use[d]; (2) without lawful authority; (3) a means of identification of another person . . . or a false identification document (4) during and in relation to any felony violation” enumerated in § 1028A(c). See United States v. Bonilla , 579 F.3d 1233, 1242 (11th Cir. 2009) (internal quotation marks omitted).

Relying on Dubin , Mr. Buchanan argues that the possession or use of M.J.G.’s signature was not at the crux of the predicate § 1028(a)(3) offense used to charge him with aggravated identity theft. In Dubin , the Supreme Court considered the meaning of the terms “use” and “in relation to” in the context of an aggravated identity theft charge under § 1028A. See 599 U.S. at 114, 116–17. A jury convicted the defendant of aggravated identity theft based on a predicate offense of committing healthcare fraud. See id. at 11315. The defendant had submitted a Medicaid reimbursement claim that inflated the qualifications of the person providing the medical care. See id. at 114. In addition to committing healthcare fraud, the government argued that the defendant had committed aggravated identity theft because the reimbursement claim included the patient's Medicaid reimbursement number. See id. at 115. ThePage 24 government further argued that the reimbursement number was a means of identification, and the defendant misused the means of identification 'in relation to' his healthcare fraud because it appeared on the reimbursement claim. See id.

Choosing between a broad or a “more targeted reading” of the statutory terms, the Court determined that “§ 1028A(a)(1)’s title and text . . . point toward requiring the means of identification to be at the crux of the criminality.” Id. at 120, 127. Specifically, the terms’ “definitions refer to offenses built around what the defendant does with the means of identification . . . . In other words, the means of identification specifically is a key mover in the criminality.' Id. at 122-23. So the Court held that § 1028A(a)(1) 'targets situations where the means of identification itself plays a key role” and requires that the means of identification “be used in a manner that is fraudulent or deceptive” rather than merely “causal.” Id. at 129, 131-32. Therefore, '[a] defendant 'uses' another person's means of identification ‘in relation to’ a predicate offense when this use is at the crux of what makes the conduct criminal.” Id. at 131. In the Court’s view, the “crux” of the defendant’s healthcare fraud there was the misstating of qualifications, not the patient’s identity. See id. at 132. Thus, the defendant could not be guilty of aggravated identity theft because the patient’s name was just an “ancillary feature of the billing method employed.' Id.

Although the Court focused on the term “use,” it noted that “Congress . . . employed a trio of verbs [in § 1028A(a)(1)] that capture various aspects of classic identity theft.' Id. at 126 (citation and Page 25internal quotation marks omitted). Because § 1028A(a)(1) also applies to a defendant who knowingly “possesses” a means of identification of another person, the Court concluded that the term “possess” was “most naturally read in the context of § 1028A(a)(1) to connote theft” and “suggest[ed] that [something belonging to another person] has been stolen.” Id. at 124-25. Moreover, ''possesses' refers to 'someone who has wrongly acquired another's means of identification, but has not yet put it to use or transferred it elsewhere.'' Id. at 125 n.7 (quoting H.R. Rep. No. 108-528, at 10 (2004)).

Mr. Buchanan argues that his conviction for aggravated identity theft must be reversed because, under Dubin , his possession or use of M.J.G.’s signature was not the crux of his predicate offense in Count II. We disagree.²

As a preliminary matter, Mr. Buchanan’s aggravated identity theft conviction is premised on his possession (rather than use) of M.J.G.’s signature because the evidence at trial did not establish that he negotiated the check containing M.J.G.’s signature. Dubin requires that the possession of a means of identification be “at thePage 26 crux of what makes the underlying offense criminal' to violate § 1028A(a)(1). See id. at 114. Here, possessing M.J.G.'s signature was “at the crux” of what made Mr. Buchanan’s § 1028(a)(3) offense criminal.

At trial, the government established beyond a reasonable doubt that Mr. Buchanan knowingly possessed (or at least constructively possessed) a fraudulent check with M.J.G.’s signature— a means of identification of another person—with the intent of using it with a corresponding identification card to negotiate at a bank. The check with M.J.G.’s signature, moreover, was authorized to an individual whose identification card was found in the white envelope in the vehicle. Mr. Buchanan intended to impersonate that individual when attempting to negotiate the check containing M.J.G.’s signature at a bank. Therefore, what made the predicate offense criminal—the intent to use identification cards to negotiate fraudulent checks—relied on Mr. Buchanan possessing and using M.J.G.’s signature to authorize the check. In Dubin , the patient’s identity was incidental to the deception about provider qualifications, and so the fraudulent reimbursement claim was not also aggravated identity theft. M.J.G.’s identity as a person who could authorize checks, by contrast, was indispensable to—“at the crux' of-Mr. Buchanan's possession of the identification cards, which he intended to use when negotiating the fraudulent checks.

Given the evidence summarized above, any error with respect to the aggravated identity theft conviction “cannot be considered plain.” United States v. Zitron , 810 F.3d 1253, 1260 (11th Cir.

Page 272016). Mr. Buchanan is not entitled to have his conviction on Count V set aside.

Mr. Buchanan also challenges a number of the district court's sentencing determinations. We address his contentions that the district court erred in imposing a sophisticated means enhancement and in calculating the amount of restitution.³

Mr. Buchanan challenges the district court’s imposition of a sophisticated means enhancement. He argues that he was simply a “worker” in the conspiracy whose role was “limited to cashing the checks that were counterfeited by [Ms.] Robinson and [Mr.] Crawford.” The government responds that Mr. Buchanan used sophisticated means, including relying on the counterfeit checks produced by Ms. Robinson and Mr. Crawford, impersonating someone else, applying superglue to his fingers, and having general knowledge of the scheme and proficiency with check fraud.

The district court’s interpretation of the Sentencing Guidelines is subject to plenary review. See United States v. Annamalai ,Page 28 939 F.3d 1216, 1235 (11th Cir. 2019). But “[w]e review the district court’s findings of fact related to the imposition of sentencing enhancements, including a finding that the defendant used sophisticated means, for clear error.” United States v. Clarke , 562 F.3d 1158, 1165 (11th Cir. 2009). We “will not disturb a district court’s [factual] findings unless we are left with a definite and firm conviction that a mistake has been committed,” but “we are not required to rubber stamp the district court’s findings simply because they were entered.' Id. (citations and internal quotation marks omitted).

The Sentencing Guidelines provide for a 2-point enhancement where a fraud-based offense 'otherwise involved sophisticated means and the defendant intentionally engaged in or caused the conduct constituting sophisticated means . . . .' U.S.S.G. § 2B1.1(b)(10). In this context, “sophisticated” means “[v]ery complex or complicated.” The American Heritage Dictionary of the English Language 1658 (4th ed. 2009). Consistent with this understanding, the application note for § 2B1.1(b)(1) defines 'sophisticated means” as an “especially complex or especially intricate offense conduct pertaining to the execution or concealment of an offense.” § 2B1.1 cmt. n.9(B).

Before being amended in 2015, § 2B1.1(b)(10) applied if the offense involved sophisticated means. See United States v. Presendieu , 880 F.3d 1228, 1244, 1248–49 (11th Cir. 2018). As currently phrased, however, the sophisticated means enhancement is both offense-based and defendant-based. District courts must therefore determine whether the defendant himself intentionally engaged in Page 29or caused the conduct constituting sophisticated means. See § 2B1.1(b)(10); U.S.S.G. App. C, Amend. 792 (U.S. Sent’g Comm’n Nov. 1, 2015).

In post-2015 cases where we have upheld the application of the sophisticated means enhancement, the defendant took “especially complex or especially intricate” steps to further the scheme. For example, in one case the defendant organized and led the criminal activity, which “involved repetitive coordinated activities and sophisticated technologies to perpetrate fraud . . . .” United States v. Bell , 112 F.4th 1318, 1342 (11th Cir. 2024) (internal quotation marks omitted). In another case, the defendant used sophisticated means by paying her salespeople through an unaffiliated company and having them “research target investors’ financial assets, sometimes rewarding salespeople for finding investors with IRA accounts.” United States v. Wheeler , 16 F.4th 805, 830 (11th Cir. 2021).

The district court found that “to get to the point where [Mr. Buchanan] participated, there was sophisticated means. Then he would basically have caused those sophisticated means.” This reasoning, however, improperly placed the focus on the sophistication of the overall scheme without sufficiently considering Mr. Buchanan’s own conduct in the scheme. The record shows that Ms. Robinson and Mr. Crawford engaged in what is perhaps sophisticated conduct by stealing checks from the mail, creating the counterfeit checks for Mr. Buchanan to cash, and obtaining identification cards for him to use. Although Mr. Buchanan used the identification cards and applied superglue to his fingers, his role in the conspiracy was limited to cashingPage 30 the counterfeit checks produced by his co-conspirators. As Ms. Robinson testified, Mr. Buchanan was simply a “worker” in the conspiracy.

With respect to the use of superglue, we note that in most criminal offenses the perpetrator takes some steps to conceal his identity. A run-of-the-mill bank robber, for example, may wear a wig or a mask. But not every attempt at concealment merits a “sophisticated means' enhancement; the attempt at concealment must be 'especially complex.' § 2B1.1 cmt. n.9(B).

We conclude that, without further findings, the district court erred in imposing the sophisticated means enhancement. First, the overall scheme was the combined work of Mr. Crawford and Ms. Robinson. If the sophisticated means existed before Mr. Buchanan’s participation, it is difficult to see how Mr. Buchanan could “then” have “caused” those sophisticated means. Second, putting superglue on one’s fingers does not seem to be especially complex. So we doubt that Mr. Buchanan “engaged in” conduct using sophisticated means by applying superglue to his fingers. See United States v. Milligen , 77 F.4th 1008, 1014 (D.C. Cir. 2023) (“For purposes of the enhancement, . . . sophistication ‘refer[s] not to the elegance, the “class,” [or] the “style” of the defrauder[,] . . . but to the presence of efforts at concealment that go beyond . . . the concealment inherent in [ ] fraud.’”) (alterations in original) (quoting United States v. Kontny , 238 F.3d 815, 821 (7th Cir. 2001)). Cf. United States v. Guldi , 141 F.4th 435, 452 (2d Cir. 2025) (“[T]here is nothing sophisticated about moving money out of one’s bank account soon Page 31after receiving a fraudulently induced transfer. . . . Guldi’s suggestion to use cashier’s checks, rather than withdrawing thousands of dollars in cash, does not transform this obvious move into a ruse worthy of an enhanced sentence.”).

We therefore vacate the sophisticated means enhancement. On remand, the district court must determine whether Mr. Buchanan “engaged in or caused the conduct constituting sophisticated means,” i.e., means which are “especially complex.”

The district court ordered Mr. Buchanan to pay $24,701.20 in restitution based on two counterfeit checks that were negotiated. Mr. Buchanan contends that the two counterfeit checks— one for $14,240.50 and the other for $10,460.70-both of which were cashed on January 27, 2022, should not have been included because he did not join the conspiracy until February of 2022. The government says that Mr. Buchanan joined the conspiracy prior to January 27, 2022, and, as a result, the district court properly included the two checks in its restitution order.

“The burden of proof for establishing restitution is upon the government by a preponderance of the evidence.” United States v. Bourne , 130 F.3d 1444, 1447 (11th Cir. 1997) (citing 18 U.S.C. § 3664(d)). “We review de novo the legality of a restitution order, but only for clear error the factual findings underpinning the order.” United States v. Moss , 34 F.4th 1176, 1192 (11th Cir. 2022).

The Mandatory Victims Restitution Act, 18 U.S.C. § 3663A, requires a defendant convicted of a fraud offense to pay restitutionPage 32 to the victims. See Moss , 34 F.4th at 1192–93. “[T]he purpose of restitution is . . . to ensure that victims, to the greatest extent possible, are made whole for their losses.” United States v. Young , 108 F.4th 1307, 1319 (11th Cir. 2024) (quoting United States v. Martin , 803 F.3d 581, 594 (11th Cir. 2015)). Restitution, however, “must be based on the amount of loss actually caused by the defendant’s conduct[.]' Moss , 34 F.4th at 1193 (quoting Baldwin , 774 F.3d at 728).

'[W]e've long understood that the [restitution] amount would take into account relevant conduct.” United States v. Utsick , 45 F.4th 1325, 1337 (11th Cir. 2022). Relevant conduct in a “jointly undertaken criminal activity” includes “all acts and omissions of others” that were (1) “within the scope of the jointly undertaken criminal activity,” (2) “in furtherance of that criminal activity,” and (3) “reasonably foreseeable in connection with that criminal activity; that occurred during the commission of the offense of conviction, in preparation for that offense, or in the course of attempting to avoid detection or responsibility for that offense . . . .” U.S.S.G. § 1B1.3(a)(1)(B). Yet relevant conduct “does not include the conduct of members of a conspiracy prior to the defendant joining the conspiracy, even if the defendant knows of that conduct . . . .' § 1B1.3 cmt. n.3(B).

Although our review of the district court’s factual findings is for clear error, we have difficulty squaring the record evidence with those findings. We explain why below.

At trial, Ms. Robinson testified that she and Mr. Crawford met Mr. Buchanan in the beginning of February of 2022 in Tampa.

Page 33Consistent with this testimony, Mr. Buchanan’s phone log showed that his first text contact with Mr. Crawford was on February 1, 2022. The presentence investigation report indicated that Ms. Robinson stated, when arrested, that “she had been driving [Mr.] Crawford and [Mr.] Buchanan around to different states and cities to cash counterfeited checks, including Jacksonville, Gainesville, Tallahassee, Panama City, Pensacola, Mobile, and cities in Mississippi” in the “month or so” prior to the arrest (which was on February 23).

Mr. Buchanan objected to the allegation in the report that he had participated in those ventures in the month leading to the arrest or that he had been to the identified cities and states. That objection put the burden on the government to present evidence supporting the disputed facts in the report. See United States v. AgisMeza , 99 F.3d 1052, 1055 (11th Cir. 1996). But the government did not present additional evidence at the sentencing hearing, and relied on the evidence presented at trial.

At the sentencing hearing, Mr. Buchanan argued that the commentary to the Sentencing Guidelines excluded conduct occurring prior to his joining the conspiracy. He also asserted that the government failed to present evidence that he joined the conspiracy prior to February of 2022, and therefore he was not responsible for the two checks cashed on January 27, 2022.

According to the district court, Ms. Robinson’s testimony— which it found credible—was that she, Mr. Crawford, and Mr. Buchanan “hit various places and made various attempts at banks in Tampa, Jacksonville . . . [and] another place.” The district court Page 34concluded that “there’s sufficient evidence to find by preponderance of the evidence that the conduct included that January conduct, or at least that [Mr. Buchanan] was a member of the conspiracy at that time.” But Ms. Robinson’s testimony at trial—which the district court credited—was that she and Mr. Crawford met Mr. Buchanan in February of 2022, not the month before.

Mr. Buchanan continued pressing his contention that, based on his release from jail on January 11, 2022, and his first documented communication with Mr. Crawford on February 1, 2022, it was “as likely as not” that he cashed the January 27, 2022 checks. In response, the district court clarified that it was “reasonable to assume” that Mr. Buchanan was part of the conspiracy in January of 2022 because, despite Ms. Robinson not providing an exact date, '[b]y the 2nd [of February], [Mr. Buchanan and Mr. Crawford] were heavy into texting back and forth and making more plans.”

Because “[a] defendant’s relevant conduct does not include the conduct of members of a conspiracy prior to the defendant joining the conspiracy,' U.S.S.G. § 1B1.3 cmt. n.3(B), whether the checks cashed on January 27, 2022, are attributable to Mr. Buchanan turns on when he joined the conspiracy. The record before us provides two competing dates for when Mr. Buchanan became a conspirator—either January of 2022 or February of 2022. Generally, a factfinder’s choice between two permissible views of the evidence is not clearly erroneous. See Anderson v. City of Bessemer City , 470 U.S. 564, 574 (1985). The problem here is that although the district court found Ms. Robinson to be credible at trial—without Page 35any caveats or misgivings—it appears to have either discounted or not accepted her testimony that Mr. Buchanan joined the conspiracy in February of 2022. Nor does the evidence or testimony presented by the government provide clarity as to exactly when Mr. Buchanan joined the conspiracy. That Mr. Buchanan and Mr. Crawford were in communication with each other on February 1, 2022, might have supported a finding that Mr. Buchanan joined the conspiracy in late January of 2022. But that inference cannot be reasonably made if Ms. Robinson’s contrary trial testimony is credited.

We therefore vacate the restitution order based on the two checks cashed on January 27, 2022, and remand to allow the district court to make further findings as to when Mr. Buchanan joined the conspiracy.

We affirm Mr. Buchanan’s convictions. We also affirm his sentence except for the application of the sophisticated means enhancement under U.S.S.G. § 2B1.1(b)(10) and the restitution order based on the two checks cashed on January 27, 2022. We remand for the district court to make additional findings on both of these matters.