Chapter 9 - WHEN THE FAMILY STORY LEFT THE HOUSE

The first employee to call me was a warehouse dispatcher named Marlene Ortiz.
She found my number in an old company directory and spoke before I could explain that I was not handling the audit.
“My rent was due yesterday,” she said. “Ethan says you froze payroll because you’re divorcing him.”
I closed my eyes.
“I didn’t freeze your pay. The company account is under review because employee records were misused.”
“He said you stole the money.”
“I’m sorry he told you that.”
Marlene breathed into the phone.
Then she said, “My husband worked nights for Leonard for eleven years. He told me never to trust the Sunday corrections.”
“What Sunday corrections?”
Leonard used to bring handwritten labor adjustments into the warehouse on Monday mornings. He claimed weekend deliveries required last-minute changes. Employees noticed that former workers sometimes appeared on printed summaries, but Leonard said old identification numbers were being reused by the software.
Marlene’s husband had questioned it once.
The next week, his overtime disappeared.
He stopped asking.
This was not a separate fraud Ethan invented after the company began failing. Leonard had used loose payroll practices for years. Ethan had modernized the method with stolen credentials and electronic transfers.
Marlene agreed to speak with Sonoran’s investigators. Two other employees later confirmed the Monday summaries and Leonard’s habit of collecting them before anyone could make copies.
The wider pattern helped my credibility.
It also placed my evidence at risk.
Sonoran discovered that several archived payroll forms had been destroyed at Prescott Mobility the night after my authorization was submitted. The destruction was not illegal by itself because some records had exceeded retention requirements, but the timing was impossible to ignore.
Ethan blamed a routine office cleanup.
Judith blamed a leaking storage room.
Leonard said he had no knowledge of it.
Then Sonoran’s forensic team examined the authentication logs from the Tucson weekend.
The fraudulent payment had not been approved using the replacement token.
It had been approved through a temporary recovery code generated by Sonoran’s help desk.
The caller requesting that code answered Claire Whitmore’s security questions and identified himself as my father.
My father had died nine years earlier.
The call had been recorded automatically for training and verification, but the company’s lawyers would not release the audio to me. They confirmed only that the caller was male and sounded older than Ethan.
The recovery request originated from Leonard’s home telephone.
Rachel read the report twice.
“So Leonard placed the call.”
“Or someone used his phone.”
She gave me a look that reminded me why she was a good attorney.
“Possible isn’t the same as reasonable.”
The forensic report included the caller’s explanation for needing emergency access:
My daughter is preparing a confidential report about financial irregularities and cannot know I’m assisting her.
Leonard had not simply stolen my identity.
He had told the help desk he was helping me expose the fraud.
That contradiction forced a larger question.
Why would he generate the payment and describe himself as my secret ally in the same call?
The answer arrived the next day, when Sonoran completed its review of Ethan’s company laptop.
May you like
Among his archived messages was one from Leonard, sent six hours before Judith attacked me:
Claire will see the weekend corrections Monday. Fix it tonight. I have pushed her as far as I can.