Chapter 17
Chapter Seventeen
EMMA
Alice called before we left for Treasury Tuesday morning.
“The credential authentication Monday night came from inside Treasury. I’ve got the device ID and the access point. I’m working through the suppression filters now to match the credential patterns against the VA disbursement activity.”
“How big is the pool?” Coleman asked.
“Right now? Too big. I need a few more hours to cut it down.”
Coleman ended the call and grabbed his keys.
I stood at the counter for another minute before I followed him to the car.
Whoever had used Mansfield’s credentials was somewhere in the building we were headed to, and I was about to walk into it with nothing but Alice’s promise that she’d have more by the end of the day.
My briefing materials were open on my desk by nine.
I read the same paragraph four times and gave up.
Marlene had organized the rest into labeled tabs, so I forced my way through them one at a time.
The GAO response needed my signature. Two interagency memos required my initials.
I signed and initialed and turned pages, and none of it registered, because my mind kept circling to the names I hadn’t seen yet.
Brad came by at ten with the revised enforcement quarterly. He walked me through the edits he’d made to the noncompliance section and pointed out supplemental data he’d pulled without being asked.
“I figured you’d want it before Friday.”
“This is exactly what I needed. Thank you,” I said.
After he left, the report sat in front of me for twenty minutes before I did anything with it.
Alice texted at eleven. She’d cut the credential pool to thirty-one but was still working. Thirty-one people in this building whose access overlapped with the suppressed alerts. I could have passed any of them in the hallway on my way to the restroom.
I sat through a conference call where three people argued about enforcement data I could have corrected in ten minutes. I let them fight it out because my attention was elsewhere.
Astrid passed my office before lunch. She slowed near the entrance and kept walking. A week ago, she would have come in without knocking.
Marlene brought me a sandwich at noon. “Darla left me a list of your favorites,” she explained. Not that I’d asked. I did remember to thank her on the way out the door at least.
Alice texted again at two. She was down to fourteen but was still cross-referencing credential logs against the dates I’d originally flagged.
I spent the next three hours distracted, unable to get a damned thing done. The briefing book for Naomi’s confirmation was due in two weeks, and at this rate, I wouldn’t have it done in two months.
Still, when Coleman came to my door at five, I shoved my laptop in my bag and grabbed my coat.
My phone rang with a call from Luke on the drive home.
“I have something to report.”
“We’re almost home. Meet us there?”
Luke was in the driveway when we pulled in. We went inside, he opened his laptop on the table, and initiated a videoconference with Alice and Tex.
“I’m at twelve people whose credential activity matches the suppressed alerts tied to the VA disbursement accounts,” said Alice.
“The shell NGOs that received the stolen VA funds share a structure,” Luke said.
“They use the same registered agent service, the same filing sequence, and the same compliance framework adapted across four jurisdictions. The person who built them has done this before. They modeled real organizations and reused the template.”
“What does that tell us?” Coleman asked.
“Whoever designed these understood how Treasury evaluates legitimate organizations and built the fakes to pass at each checkpoint. They matched the reconciliation timing and the audit thresholds. They knew which dormancy triggers would flag an inactive account. None of that is public.”
“Four of the twelve have no disbursement background,” Alice said. “Policy, legislative affairs, administrative support. They’d have the credentials, but not the institutional knowledge of how the vetting process works at the operational level. That takes us to eight.”
“The filing signatures on the registered agent service trace to a nonprofit board listed in Treasury’s records,” Luke said. “Three of the eight have no connection to it. Five remaining.”
“Of those five, one transferred to the Chicago field office eighteen months ago,” Alice said. “His access was revoked when he left. The suppressed alerts continued after his departure.”
Four.
“Another one retired six months ago,” Luke said. “Same situation. Alerts continued after his access ended.”
That left three people on the list who had disbursement tenure, a board connection, and credential activity that lined up with the stolen money.
I could tell myself it could be any of them.
I could wait for Alice and Luke to work through the rest of the data and tell me what they found.
I could sit here and let someone else say the name I’d been turning over in my head since Luke said five were remaining.
“It’s Brad,” I said.
The temperature in the room dropped.
“I’m not arguing with you,” said Luke. “But tell me why.”
“He spent five years in the disbursement division before he moved to my office. He served on a nonprofit board before joining Treasury. He has direct access to every system we’ve been talking about.”
“So do the other two,” Alice said.
“Run the timestamps on all three,” Luke said. “Compare their after-hours activity against the dates Emma was pulling her own queries on the VA accounts.”
Alice’s keyboard was the only sound for close to a minute.
“The first candidate’s after-hours sessions don’t correlate with Emma’s.
Neither do the second’s.” She stopped typing.
“Brad’s do. Every time she accessed the disbursement records, he ran queries on the same accounts within hours.
The pattern tracks hers almost exactly.”
“He was watching what I was doing and reacting to it in real time,” I said.
Three years. He’d been in the office next to mine for three years before Darla moved him to the fourth floor to make room for Coleman and Luke.
I’d hired him because his interview was the strongest I’d seen from a candidate that young, and he’d proven me right from his first week.
He anticipated what I needed before I asked.
He caught discrepancies I would have missed. He never drew attention to himself.
I’d stopped noticing him because he’d never given me a reason to. Nobody pays attention to the person who never demands it. That invisibility had protected a ten-million-dollar fraud.
This morning, he’d walked me through his quarterly revisions. I’d smiled at him and told him his work was exactly what I needed.
“The credential evidence eliminates the other two,” Alice said. “Brad’s access is the only one that mirrors Emma’s activity. It’s him.”
No one spoke.
“How much?” Coleman asked.
“At least ten million in the accounts Emma flagged,” Alice said. “That’s only what Mansfield’s system was catching. Brad had access to the routing tables. Some of the money may have moved without generating alerts.”
He’d spent five years learning which accounts were audited quarterly and which fell into gaps where nobody checked. Then he’d moved to my floor and used everything he’d learned.
Someone had put spyware on my phone. Someone had broken into my townhouse and taken my notes.
Someone had cut my brake lines. I didn’t know if Brad had done any of those things himself, but whoever did them knew what I was doing, when I was doing it, and how close I was getting.
Brad had that information. He’d had it for weeks.
“We need Atticus and Brenna on this call,” Luke said.
Coleman picked up his phone. The conversation was short. He mentioned Brad, the credential match, and that we were certain he was the one committing the fraud. He hung up less than two minutes later, and at the same time, they appeared on the screen.
“We’re here,” Brenna said. “Go ahead.”
“I don’t think Brad is working alone.” Luke leaned against his chair, stretched his arms in front of him, then returned to his keyboard.
“The external infrastructure—the shell NGOs, the offshore accounts, the compliance filings across four jurisdictions—that’s a second person.
Someone who’s built nonprofit compliance packages professionally.
Who understands external audit standards and knows how to file across multiple jurisdictions so each entity passes on its own.
That’s not something you learn at Treasury. That’s a career.”
The answer was in front of me before Luke stopped talking. My other special assistant had spent four years at a compliance consulting firm before she came to Treasury. She’d told me so in her interview. She’d built NGO compliance packages for a living.
“It’s Astrid,” I said. “The fighting between them was a cover. All of it.”
“I cleared her an hour ago,” Alice said. “Her compliance work at the firm was domestic nonprofit formation. State-level filings only. She’s never touched an offshore structure or a multi-jurisdiction compliance package. The skill set doesn’t match.”
Then, who in the hell could it be?
Luke pulled his laptop closer and started typing. No one spoke. His fingers moved for what felt like a long time. Then they stopped. He leaned back in his chair and didn’t move.
“You’ve figured out who it is,” Alice said. “Haven’t you?”
“I have,” said Luke.