*400Keith Carver entered a guilty plea in 2016 on two counts: possession of at least fifteen access devices with intent to defraud and possession of device-making equipment with intent to defraud. Later, in 2017, he pled guilty to an Information alleging aggravated identity theft. In this appeal, Carver challenges the validity of the latter guilty plea. He also challenges various aspects of sentencing for the first two counts, including the calculated amount of loss, the number of victims, and the district court's refusal to grant him an acceptance of responsibility reduction. For the following reasons, we affirm.
I.
What happens in Vegas may stay in Vegas, but during John Emmert's visit there in 2015 he learned he was somehow also staying in Greenville, South Carolina-or at least, his credit card was. Alarmed, he called the hotel, and hotel staff called the police. After a little detective work, officers Jeffrey Long and Mike Dean obtained a warrant and searched the room that Emmert had purportedly used his credit card to pay for. Keith Carver and Haidee Gillespie were inside, as well as an encoder machine (also called an "overwriter"), driver's licenses in various names, banking paperwork, more than fifty gift and credit cards under various names, drug paraphernalia, and a laptop computer. Later, Carolyn Root, a recent burglary victim, identified the laptop and some cards and paperwork as hers. The officers arrested Carver. A grand jury indicted him on three counts, and in September 2016, he pled guilty to two counts: possession of at least fifteen access devices with intent to defraud in violation of 18 U.S.C. § 1029(a)(2) and (3), and possession of device-making equipment with intent to defraud, in violation of 18 U.S.C. § 1029(a)(2) and (4).
Carver initially planned to go to trial on a third count for aggravated identity theft under 18 U.S.C. § 1028A. Upon reflection, and after learning that going to trial could affect his prospects for an offense level reduction for acceptance of responsibility, Carver pled guilty to an Information alleging aggravated identity theft (the only difference between the Information and Count 3 of the indictment being the name of the victim).
The Presentence Investigation Report calculated a base offense level of six for Counts 1 and 2. Because the offense involved the use of device-making equipment, the PSR added two levels under United States Sentencing Guidelines Manual § 2B1.1(b)(11)(A)(i). In addition, the PSR recommended a four-level enhancement because the amount of loss was between $ 15,000 and $ 40,000 under U.S.S.G. § 2B1.1(b)(1)(C). The amount of loss figure was calculated under *401U.S.S.G. § 2B1.1 cmt. n.3(F)(i), which instructs that the loss per access device is always at least $ 500. Relying on this, the PSR multiplied the number of cards found during the search of Carver's room (fifty-three) by $ 500, then added the amounts which were more than $ 500 that were charged on two devices ($ 540 and $ 1,342). The total was $ 28,382. The PSR next concluded the offense involved twenty-seven victims; because this number exceeds ten, that conclusion increased Carver's offense level by two under U.S.S.G. § 2B1.1(b)(2)(A)(i). However, because the probation officer concluded Carver had accepted responsibility, the PSR gave him a two-level reduction under U.S.S.G. § 3E1.1(a). The total offense level was therefore twelve in the PSR.
Carver objected to the enhancements for the amount of loss and number of victims. The district court held a hearing, at which Detective Mike Dean-one of the officers who searched the room-testified. He explained that he found sixty-four cards in the hotel room. Forty-four had numbers written on the back, which in his experience is common for fraudulent cards since it helps remind the user that the number on the front no longer matches what is encoded on the magnetic strip. He ran each card through a card reader to discern if the magnetic strip had been overwritten. Fifty-one of them had been. Some of the overwritten cards gave a readout of "E" as part of the code, which he thought might mean the strip now had nothing on it or was encoded improperly. Detective Dean testified that he found identification documents for eighteen victims, and he identified all eighteen by name. After this hearing, government counsel suggested that each overwritten card was an unauthorized access device, and so the proper number was fifty-one (not fifty-three). The government also revised its submission for the number of victims to eighteen (not twenty-seven). The district court agreed, but this change did not affect the offense level.
After conducting this hearing and resolving Carver's objections, the district court requested argument on whether to grant an acceptance of responsibility reduction. The plea transcript for the first two counts showed that Carver had agreed that "[t]here were over 50 gift cards and credit cards in various names scattered throughout the room ...." J.A. 128. The district court concluded, however, that Carver's remorse was not credible, that the sentencing objections were "essentially not warranted," and that the objection to the number of devices was in tension with facts agreed to in the plea transcript. It denied the acceptance of responsibility reduction. Carver's offense level was consequently 14, his criminal history category being IV, and he was sentenced to 33 months' imprisonment on Counts 1 and 2 to run concurrently, at the high end of the Guidelines range. For the identity theft charge, Carver received 24 months' imprisonment, to be served consecutive to the first 33 months, as required by statute.
II.
Carver challenges the validity of his guilty plea to the Information by pointing to various putative errors in the Rule 11 proceeding. Carver never objected to these purported errors, however, nor did he seek to withdraw his guilty plea. Notably, appellant here challenges only his second guilty plea. There is no question respecting Counts 1 and 2 of the indictment, only the Information alleging identity theft (which substituted for Count 3). In the relevant colloquy of February 16, 2017, Carver averred that he had reviewed his case with counsel, and he answered various questions under oath. He was forty-five; he attended college for two years; he was *402taking no medication or drugs. Neither counsel had any reservations in affirming that he was competent.
The government then read the Information alleging that he knowingly and unlawfully possessed a means of identification and noting the maximum punishment. The government likewise read the factual allegations, to which Carver agreed. The court then asked question after question assuring that Carver understood the nature and gravity of what he gave up by pleading guilty. He was waiving his right to go to trial, to be presumed innocent, to cross examine witnesses, to demand that the government prove all elements, and to refrain from incriminating himself. J.A. 69-70. He stated that no one had promised him anything, and that knowing all this, he wished to plead guilty. Carver's challenges on appeal to this proceeding are insubstantial, and none comes close to meeting a plain error standard.
III.
Carver likewise lodges challenges to his sentencing on Counts 1 and 2. He raises three arguments: first that the amount of loss caused by his criminal actions was miscalculated, second that the number of victims was overstated, and third that the court erroneously refused to reduce his offense level in light of his acceptance of responsibility. We deal with each in turn, holding that they are without merit. Questions of law are reviewed de novo , but factual findings will stand unless clearly erroneous. United States v. Horton , 693 F.3d 463, 474 (4th Cir. 2012).
A.
The first and most substantial objection is that the amount of loss for Counts 1 and 2 was calculated improperly because the government failed to prove that each fraudulently altered card would actually work. The Guidelines commentary gives a "Special Rule[ ]" for "Stolen or Counterfeit Credit Cards and Access Devices." U.S.S.G. § 2B1.1 cmt. n.3(F)(i). That rule is: "loss includes any unauthorized charges made with the ... unauthorized access device and shall be not less than $ 500 per access device." Id. Carver argues that, because they were not proven to work, not every overwritten card found in the hotel room counts as an "unauthorized access device," and so the $ 500 minimum should be applied to fewer devices.
In United States v. Onyesoh , 674 F.3d 1157, 1159 (9th Cir. 2012) the Ninth Circuit held that a card is not an access device if it is not functional. The court reasoned as follows: First, an "access device" is by its statutory definition "any card ... account number ... or other means of account access that can be used ... to obtain money ... or any other thing of value." 18 U.S.C. § 1029(e)(1). Any device that cannot "be used ... to obtain money" is therefore not an access device at all. Second, an "unauthorized access device" is a subset of all access devices. Therefore, any device that cannot "be used" to obtain money is not an unauthorized access device either. By this reasoning, the government would have needed to show which of the fifty-one cards could at that moment be used to obtain money, which it did not do-indeed, the district court included in the total those cards with an "E" readout.
We decline to adopt the Onyesoh usability standard. The full definition of "unauthorized access device" refutes this argument: "the term 'unauthorized access device' means any access device that is lost, stolen, expired , revoked , canceled , or obtained with intent to defraud." 18 U.S.C. § 1029(e)(3) (emphasis added). Expired, revoked, or canceled cards cannot be used to obtain money, and so Onyesoh would have three words in its statutory *403definition that mean nothing. A better statutory reading is apparent. Congress, mindful of the need to "encompass future technological changes," H.R. Rep. No. 98-894, at 19 (1984), wrote broadly to include any device of the general sort that people use to get money. The general words "can be used" signify an intent to expand the reach of the definition.
This reading is perfectly natural. A salesperson describing the features of a universal remote control might say, "This can be used on any model of television we sell." No one would think the salesperson is representing that the remote control would be currently functional-it might need batteries, reprogramming, or various other adjustments before it would work. The promise is that it is the kind of thing that, under plausible circumstances, could change channels, adjust volume, and so forth on televisions. The same is true of a fraudulently altered card. Even if it could not complete a transaction now, it is the type of thing that could do so, and was altered for precisely that purpose.
Reading the phrase "can be used" in this way is consonant with including expired, revoked, or canceled devices in the definition of "unauthorized access device." There is no need to add an extra element of current functionality that prosecutors must prove in sentencing, especially when the $ 500 minimum and capacious definition of "access device" shows that Congress sought to make the calculation straightforward. We therefore join the circuits that have rejected the usability standard from Onyesoh . See United States v. Popovski , 872 F.3d 552, 553 (7th Cir. 2017) ; United States v. Moon , 808 F.3d 1085, 1092 (6th Cir. 2015) ; see also United States v. Thomas , 841 F.3d 760, 764-65 (8th Cir. 2016) (noting the circuit split and holding that a district court did not commit plain error by failing to evaluate usability).
To meet the definition of unauthorized access device under 18 U.S.C. § 1029(e)(3), therefore, the government did not need to show that each device was currently functional, but only that it was in principle the sort of thing that people use to obtain money (like a credit card or bank number). This it did prove. Detective Dean examined each card and found that fifty-one were fraudulently overwritten. The district court did not err in accepting these as unauthorized access devices. And even if there were some error, any small error would be harmless. The same Guidelines enhancement would apply to any amount exceeding $ 15,000, while the district court calculated an amount more than $ 10,000 higher than that.
B.
Carver's second sentencing objection presented on appeal is that the number of victims for Counts 1 and 2 was miscalculated. The argument does not appear to be specific to any of the eighteen victims Detective Dean identified before the district court. Instead, the argument is simply that seeing their names on cards, bank account numbers, and identification documents is not enough to count them as victims absent corroborating evidence that they suffered pecuniary loss (which was presented for only two victims).
This argument is meritless. Moreover, it was conceded below. When asked by the district court whether the number of victims was "under ten or over ten," J.A. 122, defense counsel responded:
I asked him [Detective Dean] to identify the people and he has come up with the names. So I got nothing more to say about that part. It is just a question of whether you want to accept that testimony as people who they identify with this particular incident from 2015.... As far as the number of victims, he has *404identified I think 18, anyway, victims in connection with this case by name here in the courtroom.... [W]e have clarity, I believe, on the victim issue because the officer testified to that and I have nothing to refute that. J.A. 122-23.
This concession is fatal to Carver's appeal on this ground.
Even on its own terms, Carver's argument lacks merit. A "victim" is "any person who sustained any part of the actual loss ...." U.S.S.G. § 2B1.1 cmt. n.1. The actual loss, in turn, is, for cases involving an unauthorized access device, "any unauthorized charges made with the ... device and shall be not less than $ 500 per access device." U.S.S.G. § 2B1.1 cmt. n.3(F)(i). This provision takes note of the costs these types of crimes cause that can be difficult to measure or prove-the cost of taking protective and corrective measures, of harm to one's credit card rating, and so forth. It makes little sense to say in one breath that the harm is never less than $ 500, then in the next to say the persons affected sustained no loss. The district court did not err in concluding that the eighteen persons identified were victims. The fact that their names were on a card or device here was more than enough.
C.
Carver's final objection to his sentencing on Counts 1 and 2 is that the district court erred in denying him an acceptance of responsibility reduction under U.S.S.G. § 3E1.1(a). The defendant bears the burden of showing "he has clearly recognized and affirmatively accepted personal responsibility for his criminal conduct," and this "does not flow automatically from a guilty plea." United States v. May , 359 F.3d 683, 693 (4th Cir. 2004). We review only for clear error. Id. at 688. There was no clear error here.
The district court properly noted the delay caused by numerous objections and the defendant's seeming contradiction of facts he had previously agreed to. More importantly, the district court, which heard from Carver in-person, concluded he "really is not remorseful for what he has done. I don't find his testimony that he is sorry for what he has done to be credible." J.A. 148-49. Pleading guilty is not enough, by itself, and we must defer to the district court's credibility determination.
IV.
Financial fraud is a modern scourge. It preys especially upon the unsophisticated and vulnerable. As the district court noted, crimes like those in this case harm victims "in almost irreparable ways by causing them loss of work, mental anguish, monetary loss, and loss of peace of mind." J.A. 152. It raises costs for businesses, which must invest in security measures. These crimes require time and expertise to investigate and can be difficult to unravel and prove. This time, the government has done so, and the district court imposed a just sentence. The judgment is
AFFIRMED .