Chapter 22
CHAPTER TWENTY-TWO
Cody
By the fourth night of this, Annie stops asking before she sits in my office in the evening to work alongside me.
Tonight, the office is lit by the desk lamp, the overheads off. Cleaner that way. Less glare on the monitors.
The house has been sleepy for nearly an hour. Duke’s somewhere downstairs, probably making something unnecessarily elaborate in the kitchen because he treats stress as a challenge to improve other people’s blood sugar.
Silas is outside. I know that without checking. There’s a rhythm to his patrols when he’s carrying too much and refusing to admit it.
And Annie’s here.
Again.
Across from me, one leg folded under herself in the chair, blue hair dragged into a loose knot that’s trying to surrender.
She’s wearing one of those oversized cardigans that looks harmless until she opens her mouth and starts dismantling a fraud trail with the concentration of a forensic accountant and the temper of someone who’s tired of being underestimated.
I prefer the numbers.
The rest is increasingly difficult to categorize.
“Start with quarter three,” I say, pulling the latest vendor export onto the screen. “If the consulting fees are behaving the way we think they are, the spike won’t just align with high-volume periods, it’ll align with approval bottlenecks.”
Annie glances up from her notes. “You’re assuming they wanted procedural cover, not just visual noise.”
“I’m assuming whoever did this understands the difference.”
Her mouth shifts. “Fair.”
She leans forward, sliding a sheet toward me. “I rebuilt the timeline from the payment batch dates instead of the invoice issue dates.”
That gets my attention. “Why?”
“Because invoice dates can be manipulated without affecting posting rhythm. Batch dates are harder to fake consistently unless the person controlling them has broader access.”
I look at the sheet.
Then at her.
Then back at the sheet, because the first response is unhelpful.
The structure is sound. More than sound. Efficient, logical, annoyingly elegant in a way I would prefer to resent more than I do.
“You did this tonight?”
“Mostly.” She taps another column. “I had part of it from the weekend.”
Of course she did.
I swivel the monitor toward her and begin layering her timeline against the payment history. Consulting fees first. Then shipment approvals. Then overtime spikes.
Then legal document processing windows, because if the shell entities were built with any degree of sophistication, there will be supporting paperwork somewhere in that chain, even if it never appears directly in operations.
For the next twenty minutes, the room gets busy in the most functional way possible.
I isolate the payment clusters. Annie cross-references them against actual ranch events. Every time Ironwood’s systems are under enough pressure that routine review becomes triage, the consulting fees appear again.
“Here,” Annie says, tapping a line item with the capped end of her pen. “This week looks normal until you include staffing expansion for the south pasture repairs.”
I scan the date. “That was Jake’s request.”
“Yes, and it overlaps with two consulting charges posted forty-eight hours apart.”
“Amounts?”
She gives them to me, and I already know the answer before I run the calculation.
Together, the charges fall just under the internal threshold that would’ve required deeper manual review at the time.
Individually, they’re forgettable. Buried beside legitimate labor fluctuations and equipment costs, they disappear.
I adjust my glasses once, then take them off and set them on the desk.
“They’re not just hiding inside busy periods,” I say. “They’re splitting movement across pressure points.”
Annie nods. “So no one sees the full amount in one place.”
“No one except someone tracking behavior across departments.”
“That’s us,” she says.
“Yes.” I pull another file and expand the vendor registry. “If these are duplicate fronts, there has to be a structural tell. Documentation language, tax identifiers, remittance overlap, something.”
Annie turns in her chair, reaching for the second stack of printouts. Her knee brushes the edge of my desk. Small contact. No relevance.
I notice it anyway and resent that I do.
“I already flagged the addresses,” she says. “Most are different enough to pass surface checks. Suite numbers, abbreviations, formatting changes. But the filing behavior is weird.”
“Weird how?”
She hands me a page.
I read it once, then again more slowly. Two vendors with different names. Different addresses and service descriptions. Similar tax structure… too similar.
Not identical enough to trigger an automatic duplicate alert, because the numeric strings are offset by one transposed pair and a state suffix variation.
“Well,” I say.
Annie watches my face. “You see it too.”
“Yes.”
She leans in further, eyes on the page. “Matching tax ID variants.”
“Not exact matches. Derivative matches.”
“Engineered for similarity without detection.”
I run the numbers manually, because I don’t trust conclusions I haven’t personally verified, even when I agree with them on sight.
Same EIN base.
Different formatting behavior.
One entity listed as agricultural compliance support. Another as logistics consulting. A third under a legal-services-adjacent descriptor vague enough to survive scrutiny from anyone uninterested in asking the right question.
The same structure repeating under different names.
That’s the trick.
Not one fraudulent vendor, but several, layered. Variant identities built from the same administrative skeleton.
I sit back slowly, keeping the page in my hand while I think.
Across from me, Annie goes very still.
She knows what this means.
“This thief isn’t sloppy,” I say. “They’re experienced.”
Annie doesn’t argue. “Yeah.”
“They know how entities are screened.”
“Yes.”
“They understand approval thresholds.”
“Yes.”
“They know how to create duplicate vendors that survive a documentation pass but link back structurally if you know where to look.”
Her eyes hold mine. “Yup.”
I set the page down with more care than it deserves, because if I don’t, I’ll crumple it. And crumpling paper would be theatrically satisfying for roughly half a second and operationally worthless.
“They built a shadow path,” I say, half to myself now. “One that lets money move in increments through entities that appear separate unless you reconstruct the filing logic from the inside out.”
“That sounds very annoying,” Annie says.
“I’m very annoyed.”
That gets the faintest shift at the corner of her mouth.
Inappropriate, under the circumstances. But not unwelcome.
Still, I ignore that too.
“Pull every vendor tied to legal review windows,” I say. “Not just contract sign-offs. Anything routed through documentation support, compliance language, external counsel references, or advisory classifications.”
She’s already turning to the laptop. “On it.”
I do the same on my end, building the filter broader than I normally would because the narrower query assumes the answer sits where it belongs, and that assumption is no longer safe.
I cross-reference not just active vendors but archived ones. Dormant ones. Void later entities that only appeared once.
The search returns more entries than I want. Too many.
Which means whoever did this wasn’t improvising.
They were building options.
The room stills again except for keys, mouse clicks, the soft rasp of paper shifting against paper. Annie’s thumb taps once against the side of her camera, a rhythm I’ve now observed often enough to classify as active processing rather than nerves.
After another ten minutes, the pattern tightens.
Contract renewals, shipment disputes, staff overtime. Those are the camouflage points.
The fake consulting behavior spikes precisely when legitimate operational pressure is highest, because that’s when the system is least interested in small irregularities and most likely to prioritize continuity over scrutiny.
I track the remittance accounts next.
Most terminate where expected: standard business accounts, routing paths consistent with regional vendors, nothing outwardly useful.
Then one doesn’t.
I stop.
Read the name, read it again.
At first glance it’s almost nothing. A filing agent designation buried in shell company paperwork connected to one of the vendor variants.
Not the payee or the operating contact. Just a registration reference sitting inside a document that would normally matter only if you already suspected the entity was fabricated.
I zoom in.
The name is familiar, but from where? I can’t place it.
Annie notices the pause. “What?”
I don’t answer immediately.
I open another file. Then another. Search the name against prior contract packets. Legal correspondence. Entity registrations routed through Ironwood over the last five years.
There.
A match.
My jaw tightens.
“Cody?” Annie says.
I lean back in the chair and stare at the screen for a moment longer, because I hate this conclusion enough to want a second pass before I say it out loud.
Then I give it one.
Then a third.
Same result.
The filing reference belongs to a registration intermediary used by Tessa Grange’s legal circle.
Annie watches my face with too much intensity. “What is it?”
I turn the monitor toward her and point to the line.
She scans it once, frowns, then looks again more carefully. “I know that name.”
“You should.”
Her eyes lift to mine. “Legal.”
“Yes. This doesn’t prove Tessa is involved,” I say. “It proves one of these entities was structured through a channel tied to Ironwood’s legal circle.”
Annie exhales slowly. “Which is still very bad.”
“Yes.”
This isn’t just financial theft anymore. It’s architecture. Manipulation built with enough technical literacy to survive internal systems and enough legal familiarity to create plausible documentation trails.
The kind of person who does that is either professionally trained or standing very close to someone who is.
I remove my watch and set it on the desk.
My mind goes where it shouldn’t go first, which is exactly how I know the thought is real and isn’t just paranoia.
Family.
I hate that it arrives so quickly. I hate more that it arrives logically.
If the fraud path touches legal structuring close enough to Ironwood’s world to share intermediaries, and if the motive extends beyond simple theft into control, leverage, or reputational containment, then the circle around the problem narrows in ways I don’t want to consider.
The entire poisonous architecture of the Harlan name if you tilt it the wrong way.
I look at the name buried in the shell paperwork one more time, then close the file.
Because the next step is going to require more than pattern recognition. It’s going to require proof strong enough to survive contact with people who have spent their entire lives mistaking power for innocence.
And if my first instinct is correct, if the line from these duplicate vendors leads where I think it might…
Then the most dangerous thing at Ironwood isn’t outside the gates.
It never was.