I found the discrepancy at eleven-seventeen on a Tuesday night.

I'd been at it for six hours. The rest of the floor was dark. The building had gone quiet around nine, the way offices did — the cleaning crew at eight, then nothing. Just me and the laptop and the specific brightness of financial records that didn't add up.

I'd been working backward from sub-account 4470.

The theory was straightforward: if money was being diverted, you followed the authorization trail. Every transaction in 4470 had an authorizer, a timestamp, and an access log. If Reid was doing this, his credentials would be attached.

They were.

His credentials were on seventeen of the twenty-three transactions I'd flagged.

For the first five hours, that looked like confirmation.

Then I pulled the access logs.

Not the transaction authorization logs — those showed who approved the transaction. I pulled the system access logs: who was physically logged in to the Calloway financial system when each transaction was made.

I started matching them.

Transaction 1: authorized under Reid Calloway. Access log: Reid logged in at 14:23. Transaction timestamp: 14:31. Plausible.

Transaction 2: authorized under Reid Calloway. Access log: Reid logged in at 09:15. Transaction timestamp: 09:22. Plausible.

Transaction 8: authorized under Reid Calloway. Access log: Reid logged in at 08:45. Transaction timestamp: 08:52.

I kept going.

Transaction 14: authorized under Reid Calloway. Transaction timestamp: 19:44.

I looked at the access log.

Reid Calloway: logged out at 17:30.

I stared at the screen.

Logged out at 17:30. Transaction at 19:44.

He wasn't in the building.

I scrolled back. Cross-checked. Pulled the building's keycard entry logs from the facilities management system — they were part of the audit access, technically, though I'd never needed them before.

Reid Calloway: exited 17:28. Did not return until 07:45 the following morning.

Transaction 14 had been authorized under his credentials while he was not in the building.

I pulled transactions 15, 16, and 17.

Two of them had the same problem. Authorized under Reid's credentials. Timestamps when Reid was not in the building.

Someone had used his credentials.

Someone had access to Reid Calloway's login and had been making transactions in his name when he wasn't there.

Someone was framing him.

I sat back in my chair.

My hands were not steady.

In twenty audits I had built a case against someone and then found evidence that the case was wrong exactly never. I built careful cases. I didn't make mistakes. I'd been careful here.

And I had just found a crack.

Not proof. One crack. Three transactions out of twenty-three with timestamp anomalies. The other twenty could still be legitimate. Reid could still be involved — maybe he had an arrangement with whoever was using his credentials, maybe it was a cooperative thing, maybe he knew exactly what was being done in his name and had permitted it.

But maybe he didn't.

Maybe Reid Calloway was not the architect of this.

Maybe Reid Calloway was a frame.

I looked at the transactions again.

I looked at the access logs.

I thought about the way he'd moved in the lobby on day one. The stillness that I'd read as the specific calm of a guilty man managing the arrival of someone who might expose him.

I thought about how it might also read as the stillness of someone under surveillance by people inside the building. Someone who was being watched and knew it.

I closed the files.

I encrypted the drive.

I sat in the dark for a long time.

I did not call Marcus.

I did not know why.

I told myself: find the rest of the evidence first. Confirm. Don't act on a single discrepancy.

But somewhere underneath that, in the place where certainty lived, my certainty about Reid Calloway had just developed a fault line.

I closed the laptop.

I went home.

I lay awake for a long time thinking about timestamp anomalies and the specific kind of person who could be framed — who had enough access and enough authority that a skilled actor could use their credentials — and whether Reid Calloway was that kind of person.

Whether I had been wrong about him from the beginning.

I didn't sleep until three.
I went into the office the next morning at seven.

I unlocked the workstation.

I pulled up the access logs again.

I stared at the three anomalous transactions.

Transaction 14. Transaction 17. Transaction 19.

In each case: authorized under Reid's credentials. Timestamped when Reid's keycard showed him out of the building.

I cross-checked against Reid's calendar, which I had access to through the audit system. All three transactions occurred during events Reid had attended externally. I pulled the expense reports. He'd submitted mileage reimbursements for two of them. One of them had a dinner receipt from a restaurant three miles from the office.

He wasn't here.

And transactions were being made in his name.

I pulled back from the screen.

I thought: this is either the sloppiest frame-up I've ever seen, or it's a frame-up that someone built in a hurry, counting on nobody cross-referencing the access logs against the keycard data.

Most auditors didn't cross-reference access logs against keycard data.

I did. I always did. It was one of the three things I'd learned at the FBI that I'd carried into private practice.

I thought: someone didn't know that.

Or someone knew and didn't have time to be more careful.

I thought about Reid at his desk at nine at night.

I thought about the specific quality of his stillness the first morning in the lobby.

I thought: wrong kind of stillness.

Not guilty.

Watching.

I had been watching the wrong person.

My hands were still not steady.

I needed to figure out who I should actually be watching.