Chapter 2 - The Call Gavin Tried to Stop
Emily remained in the hospital overnight.
Robert wanted to tell her everything he suspected.
Emily stopped him.
“Facts first.”
It was a sentence her father used throughout her childhood.
Thomas Carter had built a regional commercial roofing company from one
truck and three employees.
He distrusted rumors.
He trusted invoices.
Emily inherited that habit.
Her attorney, Sarah Klein, coordinated with Thomas’s financial advisers.
The first review showed transfers from Thomas’s investment account into
Red Creek Advisory.
Some carried digital approvals that appeared to come from Emily’s
credentials.
Emily denied authorizing them.
Her limited power of attorney allowed her to pay certain bills and
manage specific household obligations.
It did not authorize speculative investments or transfers to Gavin’s
relatives.
Gavin had access to their home network.
He knew Emily’s routines.
That created suspicion.
It did not yet establish who initiated each transaction.
The flash drive could matter, but investigators had to examine it
lawfully.
Meanwhile, Sarah secured copies of account logs through proper channels.
Several approvals originated from the Carter home IP address.
One occurred while Emily was attending a conference in Chicago.
Another occurred while she was hospitalized for appendicitis.
The timing narrowed possibilities.
Gavin’s attorney argued other people had access to the house.
True.
Robert had a key.
A cleaner came twice a month.
Thomas occasionally stayed in the guest room.
Investigators did not jump to conclusions.
Then Thomas finally called from Singapore.
Emily had tried reaching him before Gavin attacked her.
Now she had to tell her father what happened.
Thomas went silent when she described the bat.
His first instinct was to fly home immediately.
Emily said, “Come home because you want to. Don’t do anything reckless.”
Thomas’s voice cracked.
“I should’ve been there.”
“No. Gavin should not have hit me.”
The distinction mattered.
Emily refused to redistribute Gavin’s responsibility onto everyone who
loved her.
Thomas confirmed he had never heard of Red Creek Advisory.
He also revealed something Emily did not know.
Six months earlier, Gavin suggested Thomas move part of his portfolio
into “higher-yield private opportunities.”
Thomas declined.
Gavin never mentioned Red Creek by name.
Robert remembered another conversation.
At Christmas, Gavin asked detailed questions about how Thomas handled
two-factor authentication while traveling.
Everyone treated it as technology talk.
Now it looked different.
Sarah warned them not to reinterpret every old conversation as proof.
Emily agreed.
The investigation would stand on records.
Then police obtained authorization to examine the flash drive.
It contained encrypted folders.
One folder was labeled T.C.
Another was labeled E.C.
A third was called AUTH.
Investigators did not immediately tell Emily what was inside.
They needed forensic copies.
Gavin learned the drive had been recovered.
Through his lawyer, he claimed it contained personal financial backups
unrelated to Thomas.
That explanation lasted less than forty-eight hours.
A forensic examiner opened the AUTH folder.
Inside were scans of Emily’s driver’s license, her limited power of
attorney, samples of her digital signature, and screenshots of security
questions from a financial portal.
There was also a spreadsheet.
Its title was:
TRANSFER SCHEDULE.
The first fourteen entries matched money that had already left Thomas’s
account.
The fifteenth had not happened yet.
It was scheduled for the following Monday.
Account logs gave investigators timestamps that could be compared with
Emily’s travel and medical records.
Thomas’s guilt became another burden Emily refused to carry; absence did
not make him responsible for Gavin’s swing.
The AUTH folder mattered because it contained identity materials with
obvious relevance to financial approvals.
The scheduled fifteenth transfer showed the suspected activity had not
merely ended before the attack.
Emily’s insistence on facts protected her from repeating Gavin’s habit
of turning assumptions into certainty.
Replacing credentials became an immediate safety measure while
investigators worked on attribution.
Account logs gave investigators timestamps that could be compared with
Emily’s travel and medical records.
Thomas’s guilt became another burden Emily refused to carry; absence did
not make him responsible for Gavin’s swing.
The AUTH folder mattered because it contained identity materials with
obvious relevance to financial approvals.
The scheduled fifteenth transfer showed the suspected activity had not
merely ended before the attack.
Emily’s insistence on facts protected her from repeating Gavin’s habit
of turning assumptions into certainty.
Replacing credentials became an immediate safety measure while
investigators worked on attribution.
Account logs gave investigators timestamps that could be compared with
Emily’s travel and medical records.
Thomas’s guilt became another burden Emily refused to carry; absence did
not make him responsible for Gavin’s swing.
The AUTH folder mattered because it contained identity materials with
obvious relevance to financial approvals.
The scheduled fifteenth transfer showed the suspected activity had not
merely ended before the attack.
Emily’s insistence on facts protected her from repeating Gavin’s habit
of turning assumptions into certainty.
Replacing credentials became an immediate safety measure while
investigators worked on attribution.
Account logs gave investigators timestamps that could be compared with
Emily’s travel and medical records.
Thomas’s guilt became another burden Emily refused to carry; absence did
not make him responsible for Gavin’s swing.
The AUTH folder mattered because it contained identity materials with
obvious relevance to financial approvals.
The scheduled fifteenth transfer showed the suspected activity had not
merely ended before the attack.
Emily’s insistence on facts protected her from repeating Gavin’s habit
of turning assumptions into certainty.
Replacing credentials became an immediate safety measure while
investigators worked on attribution.
Account logs gave investigators timestamps that could be compared with
Emily’s travel and medical records.
Thomas’s guilt became another burden Emily refused to carry; absence did
not make him responsible for Gavin’s swing.
The AUTH folder mattered because it contained identity materials with
obvious relevance to financial approvals.
The scheduled fifteenth transfer showed the suspected activity had not
merely ended before the attack.
Emily’s insistence on facts protected her from repeating Gavin’s habit
of turning assumptions into certainty.
Replacing credentials became an immediate safety measure while
investigators worked on attribution.
Account logs gave investigators timestamps that could be compared with
Emily’s travel and medical records.
Thomas’s guilt became another burden Emily refused to carry; absence did
not make him responsible for Gavin’s swing.
The AUTH folder mattered because it contained identity materials with
obvious relevance to financial approvals.
Amount: $275,000.
Emily stared at the report.
May you like
The call Gavin tried to stop had interrupted something still in
progress.
