The moment anyone asks who paid for it. I am not asking you to work for me. I'm asking you one question and then you can walk out of this office and never think about it again. She looked at him steadily. If you looked at those documents and you did not know who I was, what would you see?
It was, he thought later, the smartest thing she could possibly have said. She had removed herself from the analysis. She had made it a technical problem rather than a loyalty test. And in doing so, she had made it possible for him to answer honestly. So, he answered honestly.
He took the folder home in his head, not in his hands. And he spent the next two days inside the ordinary boundaries of his job, pulling the underlying records that any internal controls manager could pull without anyone raising an eyebrow. And on Sunday night at his kitchen table with Tess asleep down the hall and a diagram of the solar system half finished in poster paint beside his laptop, he found the thing that turned a suspicion into a fact. Electronic signatures do not exist by themselves. They are events, and events leave timestamps, and timestamps carry session data.
Elliot pulled the authentication log for one payment in particular, an $800,000 dispersement authorized at 8:43 in the evening on the 17th of April. The session originated from the Internal Network in Chicago. On the 17th of April, Marin Callaway had been on stage at a supply chain conference in Seattle delivering a 40-minute keynote to 2,000 people. Elliot found the schedule in 9 seconds. The session had run from 8:15 to 8:55 Pacific time, which meant that at the moment her credentials were authorizing that payment in Illinois.
She was standing under a spotlight 2,000 mi away with a microphone on her collar and a room full of witnesses. He called her Monday morning from the parking garage. Somebody isn't just taking money, he said. Explain. If you only want money, you hide the trail.
You use a shell, you root it, you make the paperwork boring, and you take great care that nobody's name is on anything. Whoever did this went to the opposite trouble. They attached your credentials to every single authorization. They made sure the trail led directly to a person. He watched a delivery truck back into a loading bay four floors below him.
They don't want the money to be gone. They want the money to look like you took it. There was a long silence on the line. When she spoke again, her voice had lost the polish, and what was underneath it was not weakness. It was something harder and much more tired.