So 18 USC 1029 (Fraud and related activity in connection with access devices) and 18 USC 1030 (Fraud and related activity in connection with computers) are meant to criminalize hacking. They are really meant to protect financial institutions and now other corporate networks from unauthorized access and theft. That is why the penalties are so big (10 years in prison!) compared to state law level theft. It also allows for forfeiture of any personal property used in the offense (they are thinking of computers).
The crime is really defrauding Capital One into giving you access to Gabby's accounts and obtaining more than $1k using that fraud. A PIN number is supposed to be private and unique to each person. Even if you have joint accounts, each party will get their own debit card and PIN. You agree when you open the account that you will not share the PIN with anyone else - it is supposed to be secure.
That doesn't mean everyone keeps their PINs private, I know. But you are supposed to.
An access device includes a bank card, account number, PIN, or any other way of accessing money. An “unauthorized access device” means any access device that is "lost, stolen, expired, revoked, canceled, or obtained with intent to defraud."
That's where the "intent to defraud" comes in. If the PIN owner gives you permission to use the card, your use of the card is not with the intent to defraud. The bank card is not at that point an "unauthorized access device," it is merely an access device. It is with permission or authorization.
If the PIN owner has died, and you did not notify Capital One, you are essentially posing as the PIN owner to withdraw funds which defrauds Capital One. Your access device becomes unauthorized because it is stolen or obtained with intent to defraud. Capital One would not disburse these funds to you if they knew your true identity. Instead, with the intent to deceive you used an access device to gain unauthorized access to the account.
This is a really long way of saying yes I think it means he knew she died or she never gave him permission to use the card in the first place. "Knowingly, with intent to defraud" is a high standard for a mental state but knowing that the person you are impersonating (by using their PIN) has died is acting knowingly with an intent to defraud (Capital One).