Chapter 2
Gabe Neri disappeared before midnight.
His phone went dark at 8:31.
His apartment was empty when police arrived.
His Crestline company car was found at O’Hare long-term parking.
No flight in his name.
No passport scan.
That did not mean mastermind.
It meant he knew enough to run.
The next morning, Detective Ortiz separated every problem.
That irritated Dante.
He wanted one answer.
Mara gave him seven.
First:
armed intrusion.
Second:
credential cloning.
Third:
Bianca’s unauthorized removal of the master card.
Fourth:
ghost payroll.
Fifth:
possible fraud inside Romano companies.
Sixth:
the audit drive.
Seventh:
who knew the drive was in the kitchen safe.
“Do not combine them because they happened in one room,” Mara said.
Dante looked at the broken glass being photographed.
“They’re connected.”
“Connected is not identical.”
That distinction became the spine of the case.
Then Bianca’s audit.
She was a forensic accountant by training.
Not just Dante’s fiancée.
She had spent nine years at a corporate investigations firm before joining a private investment office.
Dante met her during a vendor-fraud review four years earlier.
That should have made her secret audit less surprising.
It did not make it authorized.
Bianca began because one wedding invoice caught her eye.
Crestline billed:
twelve temporary servers.
Sofia had scheduled eight.
Bianca asked Sofia casually.
“Did four get added?”
“No.”
Then another event.
Ten workers billed.
seven present.
Could be minimum staffing charge.
Bianca checked contract.
It was not.
She asked Accounts Payable for invoices.
She had no formal role in the household finances, but because she was marrying Dante, employees often gave her things she requested.
That became important.
She compared:
Crestline invoices.
household shift sheets.
warehouse temp rosters.
event staffing records.
Same names repeated.
Some workers appeared at two places at once.
One name:
Marco Velez.
Paid for a Romano warehouse shift in Cicero from 6 a.m. to 6 p.m.
Also billed as banquet staff at Dante’s house from 3 p.m. to midnight.
Impossible.
Then Bianca searched public records.
Marco Velez existed.
But he had died three years earlier.
That was when she should have gone to Dante.
She did not.
Why?
Because one person who approved the warehouse invoices was Dante’s cousin:
Rafael Romano.
Rafael ran operations for two distribution facilities.
He had grown up with Dante.
Not brother.
Close enough.
Bianca feared accusing him without proof.
So she kept digging.
That was understandable.
Then she crossed a line.
She used household authority she did not formally have.
Requested invoices.
staff rosters.
vendor access lists.
Then the master card.
Why take it?
She wanted to see whether “ghost workers” had actual access credentials.
The system showed badge IDs for temporary staff.
But she suspected some IDs were placeholders used to make invoices look real.
The property system could not export historic details without security admin.
Bianca did not want Luis involved because Rafael and Luis were friends.
No evidence Luis was corrupt.
Bianca simply did not know whom to trust.
So she took M-01 from the security safe using Dante’s household override code.
How did she know the code?
Dante had given it to her months earlier for wedding deliveries.
Again:
informal authority.
Then she tested three staff badges.
One “ghost worker” badge opened nothing.
Another had never been activated.
Third opened:
kitchen.
service hall.
delivery entrance.
Name attached:
Marco Velez.
Dead man.
That was strong.
Then Bianca copied access logs onto a silver drive.
She also copied invoices and approval chains.
Why kitchen safe?
Because she panicked.
At four that afternoon, she received a text from an unknown number:
Stop counting people who aren’t there.
No signature.
She did not tell Dante.
Again.
She asked Sofia to store the drive temporarily in kitchen floor safe because it was offline, physical, and used for event cash.
Sofia thought it was wedding data.
Then Bianca kept M-01 in her clutch because she planned to return it after dinner.
She did not know it had been cloned.
Mara asked:
“Why not put it back immediately?”
Bianca looked at Dante.
“I was afraid someone had noticed the safe.”
“Which safe?”
“Security safe.”
If someone watched her return it, they would know she had taken it.
That logic sounded clever until bullets.
Then the card cloning.
Luis explained modern access credentials.
M-01 used older RFID technology.
Convenient.
Cloneable with cheap equipment if close enough.
The dropped emulator contained a copy of card ID.
Forensics later showed it had been read at 5:12 p.m. the previous day.
Where was Bianca then?
Kitchen passage.
With Gabe Neri.
Sofia remembered he bumped into her.
A bump could be enough if reader hidden in bag.
Then Gabe’s connection to Crestline.
Regional supervisor.
Ten years with company.
No criminal record.
Managed temporary staffing across Romano warehouses.
Who supervised him?
Crestline vice president, Alice Doran.
Who owned Crestline?
Private company:
60% Alice Doran.
40% holding company called Mesa Staffing Partners.
Who owned Mesa?
A trust connected to Paolo Santini.
There.
The rival from the opening.
Not directly through Varga yet.
But connected.
Paolo Santini owned competing trucking company.
Why would he own a staffing vendor serving Romano?
Through old investment.
Could be legitimate.
Then the ghost payroll.
Forensic accountant Priya Shah joined.
Independent.
She found household overbilling:
$281,440.
Warehouse overbilling:
possibly $2.3 million.
But not all ghost names meant fake money.
Some invoices used pooled labor codes.
some names were placeholders for agency shifts.
some were duplicate corrections.
Need classify.
Initial dramatic number shrank.
Verified questionable:
$1.1 million.
Still serious.
Then payments.
Romano companies paid Crestline.
Crestline paid temp workers.
Where did inflated amount go?
Management fees to Mesa Staffing Partners.
Then consulting payments to:
R. Romano Operations LLC.
Rafael.
Dante stared at ledger.
His cousin received $312,000 over two years.
For what?
“Labor optimization consulting.”
Did Dante know?
No.
Could be legitimate side work?
Conflict.
Not disclosed.
Then Paolo Santini’s holding company received distributions from Mesa.
So Santini profited from inflated staffing paid by Romano companies.
Motive.
But did he order armed attack?
Need evidence.
Then Varga.
Police identified from cameras.
Varga had worked for Santini in debt collections years earlier.
Recent direct ties unclear.
Phone warrant pending.
Dante wanted to call Santini.
Mara said:
“No.”
He looked.
“You do not contact a potential suspect.”
“Potential?”
“Yes.”
“You think he—”
“I think money connects. That is not enough.”
Again.
Then Rafael Romano arrived at Dante’s temporary office.
Uninvited.
He looked furious.
“You think I’m stealing from you?”
Dante said:
“I think your company got paid by our vendor.”
“For consulting.”
“Disclosed?”
Rafael stopped.
Then:
“To accounting.”
“Show me.”
He could not immediately.
He said:
Crestline hired him to redesign labor scheduling.
Done outside Romano hours.
He disclosed verbally to former CFO.
Former CFO retired.
No written conflict approval found.
Bad.
But not necessarily theft.
Then Bianca asked Rafael:
“Do you know Marco Velez?”
He stared.
“No.”
“The dead employee whose badge opened Dante’s kitchen?”
Rafael’s face changed.
That looked bad.
Then:
“I know the name.”
“How?”
“Gabe used it as a payroll placeholder.”
Silence.
“You knew?”
Rafael swore.
“He said system needed stable employee ID for floating crews.”
“Did you know the person was dead?”
“No.”
“Did you ask?”
“No.”
There.
Sloppy or complicit.
Then Dante asked:
“Did you tell Gabe Bianca was reviewing invoices?”
Rafael said no.
Too fast?
Maybe.
Then Mara asked later.
Phone records would decide.
Then Sofia.
Why had Varga grabbed her?
Not because she knew audit.
Victor? Different. Here Varga.
He thought Sofia had safe combination.
Why?
Kitchen office safe used for event cash.
Sofia was house manager.
Gabe knew.
Again:
role-based targeting.
Sofia felt sick.
The attackers had reduced her to:
person with code.
She told Mara:
“I didn’t give it.”
“Did he ask?”
“He said, ‘Give me the safe.’”
Then:
“I thought he meant money.”
He meant drive.
How did Varga know drive was in safe?
Only Bianca and Sofia knew.
Unless someone watched.
Kitchen camera.
Could be compromised.
Or phone.
Bianca had texted Sofia:
Put silver drive in floor safe, please. Do not leave in office.
That text existed.
Was Bianca’s phone compromised?
Forensics found no malware yet.
Sofia’s phone?
No.
Cloud account?
Unknown.
Then camera.
Kitchen staff camera retained motion clips to vendor cloud.
Vendor:
SafeNest Residential Systems.
Administrative support subcontracted to:
Crestline Facilities Tech.
Gabe had access.
There.
He could see Bianca hand Sofia drive.
Could see Sofia open safe? Camera angle did not show combination.
But enough to know location.
Then Dante looked at Bianca.
“You were right there was fraud.”
She nodded.
“And wrong to do it alone.”
Her eyes filled.
“Yes.”
He did not say:
therefore everything is fine.
Being right about the problem did not make the method safe.
Then he looked at Rafael’s ledger.
A cousin.
a rival’s hidden investment.
a dead man’s name in an access system.
a fiancée stealing a master credential to investigate.
The attack had started with one cloned card.
May you like
The real breach was older.
Money had been walking through his companies wearing names no one bothered to verify.
