GREGORY, Circuit Judge:

After a jury convicted him of bank fraud and aggravated identity theft, Adetokunbo Olubumi Adepoju received a seventy-month sentence. He now challenges the sufficiency of the evidence for his convictions and sentencing enhancement for sophisticated means. Also, he asserts a due process violation. We affirm the convictions and also find no due process violation. However, because the facts do not affirmatively demonstrate sophisticated means in his attempt to commit bank fraud, we vacate and remand for resentencing.

I.

In June 2010, a confidential informant ("CI") contacted law enforcement to report a man named "Olu" — later identified as the defendant — who claimed to be a real estate agent looking to sell counterfeit identification documents for $7,500. Upon instruction from Department of Homeland Security ("DHS") Special Agent ("SA") Marc Dipaola, the CI informed Adepoju that the potential customer for the documents balked at the high price. The two ceased discussing this potential transaction. One month later, Adepoju approached the CI with a plan to defraud a bank and asked whether the CI knew someone who worked at a bank. The CI led Adepoju to believe that he knew a woman in a vice president-like position at a local Bank of America who had previously assisted the CI with illegal transactions. Adepoju instructed the CI to open two accounts, into which the CI would deposit checks that Adepoju supplied. Once the checks cleared, the CI could withdraw the funds, retain his portion, pay a portion to the insider, and give Adepoju the remaining amount.

On August 31, 2010, Adepoju provided the CI with IRS documentation to use for opening a personal account in the name of "T.A." and a business account in the name of "T.A. Trucking."1 Handwritten on the back of the documents were T.A.'s name, date of birth, and social security number. The CI contacted SA Dipaola and presented these documents to the agent. Upon SA Dipaola's instruction, the CI asked Adepoju whether T.A. was a real person, and Adepoju responded affirmatively. When Adepoju later questioned whether the accounts were open, the CI presented fabricated checks, created by law enforcement, connected to fictitious accounts to satisfy Adepoju's inquiries.2

The next month, the CI received two checks from Adepoju. The first was a Wells Fargo Bank cashier's check payable to T.A. for $28,000. The second was payable to T.A. Trucking for $70,500. The CI led Adepoju to believe he would deposit the checks, but he then gave them to law enforcement. After Adepoju repeatedly asked the CI to withdraw funds from the accounts, SA Dipaola secured search warrants for Adepoju's home. The CI called Adepoju and arranged a time to deliver the withdrawn funds, yet Adepoju never met the CI or received the funds. On the day of the planned exchange, Adepoju called the CI, initially changing the meeting location before later aborting the meeting altogether.

Law enforcement executed the search warrants and arrested Adepoju at his home. Officers recovered five cellular phones, a laptop computer, and a thumb drive. The number assigned to one of the phones matched the number the CI used to call Adepoju. The thumb drive contained images of blank social security cards and a check issued by a Pennsylvania company. The images of the check showed the account number but blocked out the name of the payee. The officers also found multiple copies of a check bearing the same number but made out to different payees, one of whom was Adepoju's wife, for different amounts. Fingerprint analysis revealed the presence of Adepoju's thumbprint on the envelope used to deliver the $28,000 check to the CI.

The government charged Adepoju with two counts of bank fraud under 18 U.S.C. § 1344 and one count of aggravated identity theft under 18 U.S.C. § 1028A. At trial, the CI testified as to the aforementioned interactions with Adepoju. SA Dipaola testified that accounts at four different banks were opened in T.A.'s name shortly before the CI received his information from Adepoju, between July 28 and August 31, 2010. These accounts all listed the same Temple Hills, Maryland address that also appeared on the documents the CI received. T.A., a Pennsylvania resident, identified his social security number and birthdate on the forms Adepoju supplied to the CI. T.A. also stated that he had not authorized anyone to open accounts on his behalf, never operated a trucking business, and had never been to Temple Hills, Maryland. Testimony from Wells Fargo Bank representatives established that the checks the CI received were fraudulent and that the bank's deposits were federally insured. The representatives also explained that had the forged cashier's checks been deposited and funds been successfully withdrawn as a result, the bank would have experienced a loss.

After the jury convicted Adepoju on all counts, the district court sentenced him to seventy months' imprisonment. For the bank fraud convictions, the district court imposed forty-six month sentences, the high end of the Guidelines range. Conviction on Count Three mandated a twenty-four-month sentence, which the court imposed consecutively to the bank fraud sentences. See 18 U.S.C. § 1028A(b)(2).

Relevant to this appeal, the court applied to the bank fraud sentences a two-level enhancement for using sophisticated means under § 2B1.1(b)(10)(C) of the Sentencing Guidelines. At sentencing, the district court opined that unsophisticated means involves "something that an ordinary person, who wasn't specially trained in something, could get done." J.A. 649. The court then asked defense counsel how acquiring T.A.'s information was not sophisticated, and defense counsel explained that troves of personal information can be found via commonly-used internet search engines and other tactics. Furthermore, defense counsel noted, opening a bank account requires not sophistication but merely the proper paperwork. The government responded that no evidence supported Adepoju's claims that he used simple tactics to obtain T.A.'s information. Specifically, the government argued that there was no evidence that he used a simple internet search or other commonplace means to acquire T.A.'s name, birthdate, and social security number.

After cautioning that it did not want to place the burden on the defendant, the court noted the absence of evidence that T.A.'s information could have been retrieved via internet sources and that this absence "reinforces the view that [Adepoju's scheme] must have been sophisticated." J.A. 654. The district court then concluded that the enhancement was appropriate based on the effort required to obtain T.A.'s information, obtain the forged checks, and "do what would have worked" had the CI actually opened the account and deposited the checks. J.A. 657.

Adepoju timely appealed and now challenges the sufficiency of the evidence, the sophisticated means enhancement, and the mandatory sentence for aggravated identity theft. We have jurisdiction pursuant to 28 U.S.C. § 1291.

II.

Where a defendant challenges the sufficiency of the evidence supporting a conviction, we view the evidence in the light most favorable to the government and uphold the verdict if substantial evidence supports it. United States v. Stockton, 349 F.3d 755, 760-61 (4th Cir.2003). Substantial evidence is that which, taking all inferences in the government's favor, could lead a rational jury to find the evidence sufficient for a conviction. United States v. Burgos, 94 F.3d 849, 857 (4th Cir.1996). A defendant challenging the sufficiency of evidence "faces a heavy burden," United States v. Young, 609 F.3d 348, 355 (4th Cir.2010), and we reverse only where the prosecution's failure is clear. United States v. Moye, 454 F.3d 390, 394 (4th Cir.2006).

Challenging the bank fraud convictions, Adepoju cites an absence of evidence that he opened an account at a federally insured financial institution or presented the fraudulent checks for payment. As to the identity theft conviction, he contends that the evidence failed to demonstrate that he knew that T.A. was a real person. We disagree with both contentions.

A.

The federal bank fraud statute imposes criminal liability in two circumstances. The first is an attempted or completed scheme to defraud a financial institution. 18 U.S.C. § 1344(1). The second is a knowingly attempted or completed scheme to obtain funds by false pretenses or representation. 18 U.S.C. § 1344(2). The major difference between the subsections is that § 1344(1) focuses on how the defendant's conduct affects a bank, while § 1344(2) focuses solely on the conduct. United States v. Loughrin, 710 F.3d 1111, 1116 (10th Cir.2013). The elements of a § 1344(1) violation are (1) the defendant knowingly executed or attempted a scheme or artifice to defraud a financial institution, (2) he did so with intent to defraud, and (3) the institution was a federally insured or chartered bank. United States v. Brandon, 298 F.3d 307, 311 (4th Cir.2002); see also United States v. Flanders, 491 F.3d 1197 (10th Cir.2007). The requirements for a § 1344(2) conviction differ only as to the first element, which is that the defendant knowingly execute a scheme to obtain property held by a financial institution through false or fraudulent pretenses. Loughrin, 710 F.3d at 1115. Thus, § 1344(1) does not require fraudulent promises, United States v. Celesia, 945 F.2d 756, 758 (4th Cir.1991), or that the bank suffer any loss, Loughrin, 710 F.3d at 1116. A § 1344(2) conviction does not demand that the bank be the intended victim of the fraud; a person can violate the statute by obtaining funds from a bank while intending to defraud another person or entity. Loughrin, 710 F.3d at 1116.

As an initial matter, we address Adepoju's argument that only § 1344(1) applies here because the indictment failed to allege an affirmative misrepresentation with respect to the forged checks, a requirement for § 1344(2). We disagree with this position because the indictment cites § 1344 and references language from both subsections, thereby providing notice of intent to pursue conviction under either one. See United States v. Fontana, 948 F.2d 796, 801 (1st Cir.1991). Notwithstanding this point, his argument does not bear on our disposition because we find the evidence sufficient under § 1344(1). See Brandon, 298 F.3d at 314 (finding unnecessary an analysis of sufficiency under § 1344(2) where evidence supported conviction under § 1344(1)); see also United States v. Wilkinson, 137 F.3d 214, 232 (4th Cir.1998).

Taken in the light most favorable to the government, the evidence in this case supports the jury's conclusion that Adepoju is guilty of committing bank fraud as defined by § 1344(1). On the first element, the evidence demonstrated an attempt to execute a scheme to defraud a financial institution. Adepoju concedes that the evidence shows this incomplete attempt. As to the second element, Adepoju's intent is demonstrated by his statements, as conveyed by the CI, regarding the plan to open bank accounts under another's name, deposit checks into those accounts, and later withdraw the deposited funds. The third element, that the bank was federally insured or chartered, is satisfied by the trial testimony of Wells Fargo representatives.

Adepoju's arguments to the contrary are unpersuasive. First, he contends that the evidence failed to demonstrate a risk of loss or that he devised the scheme. Risk of loss to the bank is unnecessary for a § 1344(1) conviction, although it tends to prove the requisite intent under that subsection. United States v. Swanson, 360 F.3d 1155 (10th Cir.2004) (risk of loss is subsumed under § 1344(1)'s "defraud a financial institution" language); United States v. Hoglund, 178 F.3d 410, 413 (6th Cir.1999) (risk of loss "is merely one way of establishing intent to defraud" under § 1344(1)).3 Furthermore, the jury heard that Adepoju — not the CI — devised the plan to defraud the bank. Second, having conceded that there was an incomplete attempt to execute a scheme involving fraudulent checks, Adepoju argues that he did not take any steps constituting criminal activity. However, the evidence quells the notion that this conviction implicates mere thoughtcrime. The testimony demonstrated that he provided the CI with T.A.'s information and two forged checks for deposit. His actions, which "set[] in motion the eventual presentation of the forged instruments" to a bank, demonstrated Adepoju's intent to defraud, even though he did not personally present the checks to the bank. Brandon, 298 F.3d at 312-13. For these reasons, we affirm the bank fraud convictions in Counts One and Two.

B.

A conviction for aggravated identity theft under 18 U.S.C. § 1028A(a)(1) requires proof that the defendant "(1) knowingly transferred, possessed, or used, (2) without lawful authority, (3) a means of identification of another person, (4) during and in relation to a predicate felony offense." United States v. Abdelshafi, 592 F.3d 602, 607 (4th Cir. 2010). A means of identification is a "name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including any name, social security number, date of birth, ... employer or taxpayer identification number." 18 U.S.C. § 1028(d)(7); see United States v. Mitchell, 518 F.3d 230, 234 (4th Cir.2008) (explaining that the definition in § 1028(d)(7) applies to § 1028 and § 1028A). Relevant to the first element, the government must prove that the accused knew that the "means of identification" belonged to another person; an accused unaware that the means of identification refers to a real person cannot be guilty. Flores-Figueroa v. United States, 556 U.S. 646, 647, 654-55, 129 S.Ct. 1886, 173 L.Ed.2d 853 (2009). Knowledge of existence is enough; the accused need not know the individual personally. United States v. Foster, 740 F.3d 1202, 1207 (8th Cir.2014). Adepoju only challenges whether the evidence demonstrated he knew T.A. was a real person. We find this requirement satisfied. On no less than three occasions, the CI testified at trial that Adepoju admitted that T.A. was a real person — twice during direct examination before reiterating this point on cross-examination. This testimony provided sufficient evidence, taken in the light most favorable to the government, demonstrating Adepoju's knowledge that T.A. was a real person. Therefore, we affirm the conviction for aggravated identity theft under Count Three.

III.

Adepoju argues that the district court erred in applying a sentencing enhancement for using sophisticated means in a bank fraud scheme. In reviewing a Sentencing Guidelines application, we review factual findings for clear error and legal conclusions de novo. United States v. Allen, 446 F.3d 522, 527 (4th Cir.2006). Where a Guidelines application involves a mixed question of law and fact, the applicable standard turns on the nature of the circumstances at issue. If the application is "essentially factual," we apply the clearly erroneous standard. United States v. Daughtrey, 874 F.2d 213, 217 (4th Cir. 1989) (citation omitted). Whether a defendant's conduct involved sophisticated means is an essentially factual inquiry, thus we review for clear error. Cf. United States v. Hughes, 401 F.3d 540, 557 (4th Cir.2005) (applying the clear error standard to determine whether conduct constituted more than minimal planning); Daughtrey, 874 F.2d at 218 (finding that whether the defendant was a minimal or minor participant in a crime to be an "essentially factual" inquiry); accord United States v. Anobah, 734 F.3d 733, 739 (7th Cir.2013); United States v. Calhoun, 721 F.3d 596, 605 (8th Cir.2013); United States v. Kennedy, 714 F.3d 951, 961 (6th Cir. 2013); United States v. Bane, 720 F.3d 818, 826 (11th Cir.2013).

The Sentencing Guidelines require a two-level enhancement where a defendant uses sophisticated means in committing acts of fraud or other offenses involving theft or counterfeiting. U.S.S.G. § 2B1.1(b)(10)(C). "`Sophisticated means' means especially complex or especially intricate offense conduct, pertaining to the execution or concealment of an offense.... Conduct such as hiding assets or transactions, or both, through the use of fictitious entities, corporate shells, or offshore financial accounts also ordinarily indicates sophisticated means." U.S.S.G. § 2B1.1 cmt. n. 9(B); see Stinson v. United States, 508 U.S. 36, 38, 113 S.Ct. 1913, 123 L.Ed.2d 598 (1993) (holding that Guidelines commentary explaining or interpreting a rule "is authoritative unless it violates the Constitution or a federal statute, or is inconsistent with, or a plainly erroneous reading of, that guideline"). The enhancement applies where the entirety of a scheme constitutes sophisticated means, even if every individual action is not sophisticated. See United States v. Jinwright, 683 F.3d 471, 486 (4th Cir.2012) (applying sophisticated means enhancement under U.S.S.G. § 2T1.1(b)(2) to tax fraud). Even so, sophistication requires more than the concealment or complexities inherent in fraud. Id. Thus, fraud per se is inadequate for demonstrating the complexity required for enhancement under U.S.S.G. § 2B1.1(b)(10)(C).

It is axiomatic that the government must prove by a preponderance of evidence the applicability of a sentencing enhancement. See, e.g., United States v. Steffen, 741 F.3d 411, 413 (4th Cir.2013). In this case, the government failed to carry that burden. Adepoju's use of forged checks and a stolen identity to attempt bank fraud is beyond dispute. Indeed, virtually all bank fraud will involve misrepresentation, which includes unauthorized acquisition and use of another's information. See United States v. Archuletta, 231 F.3d 682, 685-86 (10th Cir.2000) (holding that the defendant's use of a false name and checks to obtain funds from a credit union constituted "evidence of nothing more than the minimum conduct required to establish a violation of [18 U.S.C.] § 1344 in its simplest form"). Therefore, the realm of especial complexities and intricacies involves more than the forgeries, misrepresentation, and concealment inherent in bank fraud. See United States v. Montano, 250 F.3d 709, 715 (9th Cir.2001) (finding that because smuggling necessarily involves concealment, sophisticated means requires more than what is necessary to commit the crime).

The district court clearly erred by essentially shifting the burden to Adepoju to disprove sophistication. See United States v. Guzman, 318 F.3d 1191, 1198 (10th Cir.2003) (vacating a sentencing enhancement where the district court applied the enhancement after finding a lack of evidence supporting the defendant's position). While the district court expressed an understanding that it would be improper to place a burden on the defendant, that is exactly what it did. It began by presuming that acquiring T.A.'s information was accomplished by sophisticated methods, without any evidence as to how Adepoju acquired this information. The court then asked Adepoju for evidence that he acquired the information in a non-sophisticated manner. Then, finding Adepoju's argument against sophistication unpersuasive, it applied the enhancement based on the stolen information and plan to commit fraud. While demonstrating that Adepoju did enough to violate § 1344 "in its simplest form," see Archuletta, 231 F.3d at 685-86, the facts concerning the crime of conviction do not affirmatively indicate that he did anything especially intricate or complex to obtain T.A.'s information or attempt to defraud a bank, see Jinwright, 683 F.3d at 486 ("The [sophisticated means] enhancement requires some means of execution that separates the offense before us from the ordinary or generic.").

A clear error occurs where we are left with a firm and definite conviction that a mistake has been committed. United States v. Dugger, 485 F.3d 236, 239 (4th Cir.2007). Here, the lack of evidence or explanation of sophistication is clear. See United States v. Llamas, 599 F.3d 381, 389 (4th Cir.2010) (vacating enhancement application where sentencing court "failed to provide a sufficient explanation of its finding" supporting enhancement). The reasoning for the enhancement here essentially amounts to a tautology, where the district court used the presence of the tools to commit fraud and the plan to use those tools, combined with a lack of explanation of non-sophistication, as proof of sophistication. However, neither the record nor common sense suggest that names, birthdates, and social security numbers can be obtained only by sophisticated means. There is no evidence of how Adepoju obtained that information. Additionally, the government conceded that obtaining an EIN, even for a falsified company, "is something that's not too difficult to do." J.A. 655. Thus, the mere possession of such information cannot, on its own, demonstrate sophistication. Nor was there any explanation by the court as to how the planned conduct was especially complex or intricate above and beyond typical § 1344 violations. Cf. Llamas, 599 F.3d at 388-89. The government's burden demands more than the mere presence of the tools of fraud and the attempt to use the same. If Adepoju's current offenses did in fact employ sophisticated means, the government's evidence and the court's conclusory finding did not demonstrate this.4

We conclude that the district court clearly erred in imposing the sophisticated means enhancement of § 2B1.1(b)(10)(C). This result stems not from weighing the evidence but from the absence of factual findings where the district court gives little, if any, to consider. See Llamas, 599 F.3d at 389. Our conclusion by no means requires that the court find the existence of "highly complex schemes" or "exceptional brilliance to justify a sophisticated means enhancement." United States v. Jennings, 711 F.3d 1144, 1145 (9th Cir.2013). The enhancement for sophisticated means does require more than just thoughtful or potentially successful planning. Bank fraud requires plans to wrongfully acquire funds and, where § 1344(1) is at issue, misrepresentation. The presence of forgeries or stolen identification, and a plan to use such material to wrongfully acquire moneys, does not necessarily amount to sophistication. If Adepoju's efforts involved something especially more intricate and complex than what is required to violate the bank fraud statute in its simplest form, the court failed to identify those aspects. To affirm in the absence of such proof would permit enhancement where the mere presence of and plan to use fraudulent materials is combined with a defendant's inability to prove a lack of sophistication. We refuse to endorse such an approach.

IV.

Adepoju argues that his right to due process was violated because the facts supporting the two-year minimum for aggravated identity theft were not properly presented to the jury. Cf. Alleyne v. United States, ___ U.S. ___, 133 S.Ct. 2151, 186 L.Ed.2d 314 (2013). We apply plain error review to an objection based upon a new rule of law not in effect at the time of the contested proceeding. Henderson v. United States, ___ U.S. ___, 133 S.Ct. 1121, 1126-27, 185 L.Ed.2d 85 (2013); see United States v. Olano, 507 U.S. 725, 732, 113 S.Ct. 1770, 123 L.Ed.2d 508 (1993) (explaining plain error standard). In Alleyne, the defendant was charged under a statute that imposed varying mandatory minimums based on different factual scenarios, and the Supreme Court held that a jury must make special findings as to any facts increasing mandatory minimums. 133 S.Ct. at 2155-56, 2158, 2160. The aggravated identity theft statute now at issue does not involve varying mandatory minimums. A finding that Adepoju knowingly transferred, possessed, or used another's means of identification could only result in a consecutive two-year sentence. See 18 U.S.C. §§ 1028A (a)(1), (b)(2). The jury's verdict thus supports the two-year sentence for this charge. No error, plain or otherwise, occurred.

V.

For the foregoing reasons, we affirm Adepoju's bank fraud and aggravated identity theft convictions. We also affirm the consecutive two-year minimum sentence for aggravated identity theft. Because the evidence failed to demonstrate that Adepoju engaged in especially complex or intricate behavior above and beyond that inherent in fraud, we vacate his sentence and remand for resentencing without the enhancement and consistent with this opinion.

AFFIRMED IN PART, VACATED IN PART, AND REMANDED.