Just to correct you on this, nowhere has it said it's for the use of Gabby's card, simply the unauthorised use of a card.
Small point: the relevant statute's wording is "knowing" "use of an unauthorized access device" with "intent to defraud."
So it's the knowing use of a lost/stolen/etc. device, with the intent to defraud (~steal).
"Unauthorized access device" is defined in the statute as an access device (card, PIN, etc.) that is (among other things) lost, stolen, expired, canceled, etc.
18 USC 1029(a)(2) is the statutory reference; definitions are in 1029(e).