Part 7
Joanne’s second email arrived five minutes later.
It was shorter than the first.
More uncertain.
“Ms. Hart,
I received a response stating that Mr. Vance reviewed my concerns and considered the matter resolved. I respect that decision, but I am confused because no one asked to see the photographs or records I mentioned. I may have misunderstood the process. Could you please confirm whether Mr. Vance personally reviewed the materials?
Thank you,
Joanne Parker”
Evelyn had never answered.
Instead, the email sat in an archive.
Three weeks later, Joanne was dismissed.
I read it several times.
Not because it contained new evidence.
Because it contained something more difficult to quantify.
Joanne had been giving us another chance.
Even after receiving a dismissive response carrying my name, she had assumed there might have been a misunderstanding.
She had written politely.
Carefully.
Asking for confirmation.
Nobody replied.
Margaret broke the silence.
“We found Gavin Price.”
“Where?”
“Consulting firm in Denver.”
“Call him.”
Priya raised a hand.
“Let me.”
Twenty minutes later, Gavin was on video.
He had the slightly distracted expression of someone pulled out of another workday.
When Priya explained why we were calling, his eyebrows rose.
“I remember the domain.”
“Who had access?” she asked.
“Security team.”
“Anyone outside security?”
“Temporarily.”
“Who?”
“Nathan Harrison.”
“Why?”
Gavin frowned, remembering.
“He requested it for a vendor-fraud simulation.”
Margaret and I exchanged looks.
“A what?” I asked.
“We were testing whether finance employees would recognize a spoofed executive email approving a payment.”
“When?”
Gavin gave us the approximate month.
It was two months before Joanne’s first message.
“What credentials did Nathan receive?”
“Limited sender access.”
“Was it revoked?”
“It should have been.”
“Was it?”
Gavin stared at us.
“I’d have to check records.”
“You don’t work here anymore.”
“I kept administrative logs from the transition on encrypted backup.”
Priya smiled.
“Would you be willing to check?”
“Yes.”
“Did Richard Danner ever have access?”
“Not directly.”
“Daniel Mercer?”
“No.”
“What about Nathan after the simulation?”
Gavin hesitated.
“There was an issue.”
My attention sharpened.
“What issue?”
“A test message was sent after the simulation ended.”
“By whom?”
“We couldn’t prove it.”
“Who still had credentials?”
“Nathan’s account had not been disabled properly.”
There it was.
Not proof.
But the line was narrowing.
“Did you report it?”
“To Nathan.”
I stared at him.
“You reported unauthorized use of Nathan’s credentials to Nathan?”
Gavin looked embarrassed.
“At the time, we assumed someone on his team had reused them.”
“Did you report it to anyone else?”
“Daniel.”
Finally.
“What did Daniel say?”
“That he’d handle it.”
“Did he?”
“I don’t know.”
Now Daniel’s role required an explanation.
Not because he had approved Bellmont.
Because he had been told there was a security problem involving an executive impersonation domain.
And apparently the domain remained usable long enough for Joanne to receive a message from it.
I called Daniel myself.
He answered warmly.
“Mason. I heard you landed in San Antonio without warning. Should I be worried?”
“Yes.”
Silence.
“All right.”
“I’m in a conference room with Margaret and Priya.”
“That sounds even worse.”
“Do you remember Gavin Price reporting unauthorized use of a look-alike executive domain?”
Daniel exhaled.
“Yes.”
“What did you do?”
“I asked Nathan.”
“And?”
“He said a procurement analyst had reused it accidentally during a training exercise.”
“Did you verify that?”
“No.”
“Why?”
“I trusted him.”
There it was again.
The same two words.
I trusted him.
Daniel continued.
“What is this about?”
“Joanne Parker.”
He said nothing.
“You know the name?”
“No.”
“Grand Crest cook. Reported purchasing fraud three years ago.”
“I don’t remember.”
“Someone sent her a fake email using my name.”
Daniel’s voice dropped.
“From the training domain?”
“Yes.”
“Oh, no.”
“Bellmont Artisan Foods.”
Another silence.
“I approved that contract.”
“Yes.”
“Richard’s vendor.”
“Yes.”
“I reviewed procurement’s recommendation.”
“Whose recommendation?”
“Nathan’s.”
We were getting closer.
“Did Nathan disclose any relationship?”
“No.”
“Did Richard?”
“No.”
“Did you verify ownership?”
“That was procurement’s responsibility.”
I closed my eyes.
Another layer.
Another person assuming another department had checked.
Daniel sounded shaken.
“Mason, I signed it.”
“You authorized it.”
“That’s the same thing.”
“No. It isn’t.”
“It feels like it is.”
I understood.
But feelings were not evidence either.
“Come to San Antonio.”
“When?”
“Today.”
“I’ll get a flight.”
No argument.
May you like
No attempt to manage the situation remotely.
That counted for something.
