Debit-Card Numbers and PINs as “Means of Identification”:
A Structured Commentary on United States v. Constantinescu, 91 F.4th ___ (2d Cir. 2025)

1. Introduction

The Second Circuit’s decision in United States v. Constantinescu resolves several doctrinal questions arising out of a multi-national ATM-skimming conspiracy, the most important being whether stolen debit-card numbers and personal identification numbers (PINs) qualify as a “means of identification” under the federal aggravated-identity-theft statute, 18 U.S.C. § 1028A. The appeal also addresses a Fourth Amendment challenge to a garage search, multiple Guidelines issues, and the perennial controversy over delegating restitution-payment schedules to the Bureau of Prisons’ Inmate Financial Responsibility Program (IFRP). The judgment results in (a) affirmation of the convictions and sentences of Mircea Constantinescu and Nikolaos Limberatos, (b) vacatur and remand limited to clarification of Constantinescu’s restitution payment schedule, and (c) the creation of a clear Second Circuit precedent on what constitutes a “means of identification.”

2. Summary of the Judgment

• Aggravated Identity Theft: Debit-card numbers and PINs are “access devices” under § 1029(e) and therefore “means of identification” under § 1028A(d)(7)(D). Convictions affirmed.
• Fourth Amendment: A garage reachable through an interior door off a foyer is “immediately adjoining” the arrest site; thus, entry during a protective sweep was lawful, and evidence later seized under a warrant was admissible.
• Sentencing:
  • Limberatos – 120 months (below-Guidelines), multiple enhancements upheld, no acceptance-of-responsibility reduction.
  • Constantinescu – 92 months (below-Guidelines), disparity with co-defendant wife not unwarranted.
• Restitution: Installment schedule for Constantinescu vacated and remanded because the order arguably delegates scheduling to the BOP contrary to Porter and Mortimer.

3. Detailed Analysis

3.1 Precedents Cited and Their Influence

• Maryland v. Buie, 494 U.S. 325 (1990) – Defined scope of protective sweep. Court analogized garage here to “spaces immediately adjoining” an arrest site.
• United States v. Porter, 41 F.3d 68 (2d Cir. 1994) & United States v. Mortimer, 94 F.3d 89 (2d Cir. 1996) – Establish limits on delegating restitution schedules. Used to analyze IFRP clause.
• United States v. Delgado, 124 F. App’x 694 (2d Cir. 2005) and United States v. Henderson, 439 F. App’x 56 (2d Cir. 2011) – Earlier, unpublished decisions involving “access devices”; cited to support classification of debit-card data.
• United States v. Lauter, 57 F.3d 212 (2d Cir. 1995) & United States v. Gandia, 424 F.3d 255 (2d Cir. 2005) – Framework for protective sweep limitations.
• Numerous Guidelines cases (Moseley, Turk, Rubenstein) – Instruct loss and enhancement calculations.

3.2 Core Legal Reasoning

3.2.1 “Means of Identification” Holding

The panel applied textual analysis:

1. § 1028(d)(7)(D) includes any “access device” defined in § 1029(e)(1).
2. § 1029(e)(1) explicitly lists “personal identification number” and, via a catch-all, any “other means of account access … to obtain money.”
3. Debit-card numbers, though not individually enumerated, are quintessential “means of account access” when combined with a PIN.

Rejecting defendant arguments that card data are linked to accounts (not persons), the court stressed statutory breadth – the data “identify a specific individual” through account linkage. The holding is therefore grounded in plain statutory text rather than legislative history or policy-based extrapolation.

3.2.2 Protective Sweep into the Garage

Key factual findings (credited over defendant’s affidavit) supported legality:

• Arrest occurred in foyer; suspect partially clothed = no immediate removal.
• Kitchen visible and unobstructed from foyer; kitchen door opens into garage.
• Garage therefore “immediately adjoining.”

Under Buie, officers need no suspicion to inspect spaces “from which an attack could be immediately launched.” Plain-view doctrine then legitimised probable-cause photos and the later warrant. Even assuming a secondary entry by the affiant exceeded sweep limits, harmless-error analysis (overwhelming independent evidence; duplicated observations by sweep officers) left conviction secure.

3.2.3 Sentencing Enhancements

The court meticulously addressed seven disputed enhancements, emphasizing:

• Loss & victim numbers: “Reasonably foreseeable” standard; testimony of millions laundered by Tita’s group + dozens of skimming jobs.
• Sophisticated means: Custom-built skimmers, hidden cameras, overseas laundering.
• Device-making equipment: Not impermissible double counting because base-offense level hinged only on statutory maximum, not equipment possession.
• Leadership role: Evidence of building devices, scouting ATMs, supervising cash-outs.
• No acceptance-of-responsibility reduction: Defendant continued to dispute foundational facts at trial & sentencing.

3.2.4 Restitution Delegation Problem

Although the order used permissive language (“may” participate in IFRP), the absence of any alternative schedule risked functional compulsion, indistinguishable from the impermissible delegation in Mortimer. The panel therefore vacated and remanded for clarification, but did not announce a categorical rule—leaving room for district courts to craft compliant orders.

3.3 Likely Impact of the Decision

1. Identity-Theft Prosecutions: Prosecutors can confidently charge § 1028A when only card numbers and PINs are stolen; defense arguments that these identify “accounts not persons” are foreclosed within the Second Circuit.
2. Protective-Sweep Doctrine: Confirms that garages reached through internal passages may be “immediately adjoining,” an extension useful to law enforcement yet mindful of Buie limits.
3. Sentencing Practice: Reinforces expansive application of loss, leadership, sophisticated-means, and device-making enhancements in cyber-fraud contexts.
4. Restitution Drafting: District judges must stay vigilant: a mere suggestion of IFRP participation is safe only if a fallback dollar-and-time schedule is expressly articulated.
5. Inter-Circuit Dialogue: Other circuits (notably the Fifth and Ninth) have dicta parsing “means of identification.” This opinion may be cited nationwide and could influence Supreme Court interpretation if circuit splits emerge.

4. Complex Concepts Simplified

• Access Device (§ 1029(e)) – Broad term embracing any code or number (card, account, ESN, PIN, etc.) that lets you obtain money or goods. Think of it as the “key” to an account.
• Means of Identification (§ 1028(d)(7)) – Any name/number/biometric that can pinpoint an individual. Since an account ultimately belongs to a person, its unique number qualifies.
• Protective Sweep – A quick security check “incident to arrest” limited to spaces close enough for a hidden assailant to launch an attack.
• IFRP – Internal BOP program reviewing inmate accounts every six months and setting voluntary payment amounts. Courts cannot force participation but may encourage it while still specifying minimal required payments.
• Impermissible Double Counting – Applying two Guideline enhancements aimed at punishing the same specific conduct. It’s allowed when each enhancement targets a different facet (e.g., possession of equipment vs. leadership role).

5. Conclusion

United States v. Constantinescu is most significant for its textual, precedent-setting declaration that debit-card numbers and PINs are covered “means of identification” under the aggravated-identity-theft statute. The ruling harmonises the statutory definitions of “access device” and “means of identification,” closing a defense loophole in ATM-skimming and similar fraud cases. Additionally, the opinion refines protective-sweep boundaries, underscores rigorous but defendant-unfriendly loss and role calculations under the Guidelines, and issues a cautionary reminder about restitution orders that flirt with unlawful delegation. In the broader landscape of cyber-enabled financial crimes, the Second Circuit has equipped prosecutors with a clearer charging pathway, given district courts a template for lawful protective sweeps, and nudged sentencing and restitution practice toward greater doctrinal clarity.