Chapter 7
Friday. The day before the gala. I should be fully immersed in final logistics — the walk-through, the vendor confirmations, the last-minute seating adjustments because the CMO's wife can't sit near the VP of Marketing's husband due to something that happened at a dinner party in March.
I told him I had an early vendor meeting. He didn't question it. He never questions my schedule. My schedule is a wall of green checkmarks that he long ago stopped trying to understand.
He's at the pharmacy counter. I can see him through the glass — khakis, blue polo, the posture of a man who doesn't know he's being watched.
He hands something to the clerk. She types.
He waits. He checks his phone — scrolls something, probably sports scores or the group chat with his college friends that he never contributes to but always reads.
She hands him a white bag. He signs something — the digital pad, probably.
Doesn't read what he's signing. Never reads what he's signing. That's how we got here.
Then he walks out. Gets in his car. Sits there for a moment — checking something on his phone again. Then drives to work. Left turn onto Main. Gone.
I wait four minutes. Count them on the dashboard clock. 8:34. 8:35. 8:36. 8:37. 8:38. Then I walk in.
The pharmacy counter is empty except for the clerk — young, nose ring, nails with tiny butterflies painted on them.
She's restocking a shelf behind the register.
I stand there for a moment. My heart is doing something fast and arrhythmic — the flutter of a woman about to do something she knows is wrong.
"Hi," I say. "I'm calling — I mean, I'm here on behalf of James Mercer? He asked me to check on his file. I'm Ruby. Ruby Khoury."
The words leave my mouth and I hear them from the outside. I'm impersonating her. I'm standing at a pharmacy counter pretending to be my best friend because that's the fastest way to find out what she's done.
The clerk doesn't even look up from her screen. "Sure. What does he need?"
"Can you confirm who's listed as his emergency contact?"
She types his name. Looks at the screen. "Emergency contact shows... Ruby Khoury. Friend." She glances at me. "That's you?"
"That's me."
Eight.
"Anything else?"
"Actually — he wants to update that. Change it to his wife. Calla Mercer." I give her my real number. She types it in. No verification. No ID check. No callback to James.
"Done. Anything else?"
"No. Thank you."
I walk away from the counter on legs that feel borrowed.
My face is hot. The fluorescent lights buzz overhead like a judgment — white and clinical and exposing every cracked surface.
I buy a bottle of water I don't need on my way out so the transaction feels complete.
So I feel like a customer and not a woman who just impersonated her best friend at a pharmacy counter.
In the car, I sit with it. With what I just did.
I pretended to be Ruby. I used her name. I exploited the same weak system she exploited — no verification, no proof, just a name and a phone number and a claimed relationship. The same vulnerability that let Ruby add herself to the dentist without anyone checking.
I used her weapon.
And it took twelve seconds. Twelve seconds to change the person who would be called if my husband had a medical emergency at this pharmacy. No proof required. No verification. Just a voice and a name and the system accepting whoever shows up first.
I grip the steering wheel. My knuckles are white. I just did something I can't undo — not the change itself, that's correct, my name SHOULD be there — but the method. I lied. To a stranger. While investigating a friend who lied to strangers. I used the exact playbook I'm building a case against.
The moral high ground — if I ever had it — just shifted under my feet.
I'm not the clean victim of this story. Not anymore.
I'm someone who walked into a Walgreens and pretended to be another woman because the direct route — asking James, waiting, trusting the process — was too slow.
Too uncertain. Too much like the version of me who let this happen for three years because I didn't check.
I did the thing I'm angry at Ruby for doing.
I open the notes app. Add to the timeline with hands that won't quite steady:
[Date unknown] — Walgreens pharmacy: emergency contact (Ruby listed. Date of entry unknown — potentially from first prescription fill.)
Method of verification: impersonated Ruby. Changed back to my name.
I stare at that second line. Then I delete it. Nobody needs to see that part. Nobody except me, sitting in this parking lot, knowing exactly how easy it is to become the person you're angry at.
I sit in my car after. Engine off. The water bottle sweating in the cupholder. Add to the timeline:
[Date unknown] — Walgreens pharmacy: emergency contact (Ruby listed. Date of entry unknown — potentially from first prescription fill.)
Eight confirmed.
I look at the spreadsheet on my phone. Felix added the call script last night — a list of everywhere else I can check today. Three more are accessible without James: the home security company, the homeowner's insurance, and Sophie's pediatrician.
I make the calls from the parking lot. One by one.
Methodical. The way I'd confirm vendor contracts the week before an event.
Each call takes between three and seven minutes.
Between calls, I swipe the planning app.
Not looking for anything. Just needing the green.
Needing something to be confirmed and correct and running on schedule while everything else unravels.
Home security — Sentinel Alarm Systems. James set it up when we bought the house.
Monitoring notifications go to two numbers: mine and James's.
No Ruby. I feel a spike of something — relief?
surprise? — before the operator adds: "But the authorized persons list for system changes includes a Ruby Khoury. Added November 2023."
Not notification contact. AUTHORIZED PERSON. She can change our alarm codes. She can disarm our house.
I grip the steering wheel with my free hand.
The leather is warm from the sun through the windshield.
Outside the Walgreens, a woman is loading groceries into her trunk.
A man is walking a beagle. Normal morning.
Normal people living normal lives where their best friend doesn't have the code to their home security system.
"What exactly can an authorized person do?" I ask.
"They can arm and disarm the system, change entry codes, add or remove users, and adjust monitoring settings. They'd also be contacted if there's a system malfunction or a triggered alarm that the primary contacts don't respond to."
She can change my alarm code. She can let herself into my house without triggering an alert. She can change the settings — disable a zone, silence a sensor.
"When was she added?"
"November twelfth, 2023."
November 2023. I was in Vegas. The tech conference. Three thousand attendees. I remember because the keynote stage had a hydraulic failure during rehearsal and we had to rebuild the entire setup in four hours.
While I was rebuilding a stage in Las Vegas, Ruby was being given the keys to my house.
November 12, 2023 — Sentinel Alarm: authorized person (can change codes, disarm system. James added via phone.)
Nine.
Homeowner's insurance — Allstate. I call. Verify the file. Emergency contact for the policy: Calla Mercer. No Ruby.
One gap. One place she isn't.
Sophie's pediatrician — Dr. Ramirez at Greenfield Pediatrics.
I'm the primary parent on the account. I pull up the portal on my phone — the screen bright in the car's dim interior, the parking lot emptying around me as the morning rush clears.
I navigate to the account settings. Authorized contacts.
Authorized to receive medical information: Calla Mercer (mother), James Mercer (father).
Emergency contact if parents unreachable: Ruby Khoury (family friend). Added January 2024.
My daughter. My seven-year-old daughter's medical file.
The file that tracks her vaccinations, her growth chart, her tree nut allergy that requires an EpiPen.
The file that would be accessed if she had an allergic reaction at school.
If she broke her arm on the playground. If she was rushed to the ER.
And the person they'd call if James and I were both unreachable — the third line of defense for my child's body — is Ruby.
January 2024 — Pediatrician: emergency contact for Sophie (if both parents unreachable. James's account submitted.)
Ten.
Ten confirmed systems where Ruby exists. Three years and ten months of entries. Auto, gym, dental, school, hospital, life insurance, HR, pharmacy, home security, pediatrician.
Ten places where, if something went wrong — with James, with our house, with our daughter — Ruby would be called. Ruby would be notified. Ruby would be authorized.
I sit in the Walgreens parking lot and count them on my fingers. Both hands. All ten fingers.
Ten. The number feels different when you reach it with your body. Not abstract. Not a cell in a spreadsheet. Ten fingers. Ten places. Ten moments where Ruby's name was typed or written or spoken into a system that is supposed to protect my family — and the person protecting it is someone else.
My phone buzzes. Felix: Status report? How many?
Ten.
Holy shit.
Yeah.
Come into the office. I need to update the board.
I'm already driving.
Bring food. You haven't eaten. I can tell by the ellipsis speed of your texts.
He's right. I haven't eaten. I stop at the sandwich place on Main — the one Felix likes, the one with the smoked turkey on sourdough that he calls "architecturally perfect." I get two. I eat mine in the car at a red light. It tastes like nothing. I eat it anyway.
* * *