Chapter 3
Rafael Romano had not invented the ghost payroll.
That fact saved him from one accusation and exposed him to another.
The scheme began four years earlier under Crestline’s former payroll director, Martin Hess.
Hess discovered Romano warehouses paid temporary labor by:
headcount.
shift class.
overtime tier.
Not by individually verified person in every invoice.
Crestline submitted weekly rosters.
Romano supervisors approved totals.
Names mattered less than numbers.
Hess created “stability profiles.”
Fake identities that remained in the system so temporary staffing could be billed consistently even when actual workers changed day to day.
At first, the billing totals roughly matched real labor hours.
Still improper.
Then it evolved.
Some stability profiles billed hours no one worked.
Difference became margin.
Managers called it:
coverage reserve.
That phrase appeared in emails.
No one wrote:
steal money.
They wrote:
smooth staffing volatility.
protect minimum coverage.
avoid reconciliation noise.
The language made fraud feel administrative.
Then Mesa Staffing Partners bought 40% of Crestline.
Paolo Santini’s investment vehicle.
Hess left.
Gabe Neri inherited the system.
He expanded it.
That was where overbilling grew.
Then Rafael.
Crestline hired him as consultant.
Why?
Because Romano warehouses were complaining about unstable crews.
Rafael knew scheduling.
He built templates.
Was he paid from inflated money?
Yes.
Did he know?
Evidence mixed.
One email from Gabe:
Ghost slots give us flexibility.
Rafael replied:
I don’t care what you call float slots. Bill actual bodies.
That helped him.
Then another month later:
Gabe:
Need twelve on paper to hold rate even if ten show.
Rafael:
Do what contract allows.
Bad.
He did not ask whether contract allowed.
It did not.
Then:
Crestline paid Rafael bonuses tied to “margin retention.”
That made conflict worse.
He claimed he thought margin came from reduced overtime.
Some did.
Some from ghost billing.
Did he see reports?
Yes.
Could he have known?
Probably.
Could prosecutors prove intent?
Not yet.
Then the $312,000.
About $190,000 was legitimate consulting under documented hours.
$122,000 came from margin bonuses tied to inflated billing.
Rafael agreed to repay disputed amount pending civil resolution.
No admission yet.
Dante hated that.
He wanted clean guilt.
Forensic accounting kept producing mixed columns.
Then Paolo Santini.
His investment did profit.
But did he know ghost payroll?
Board emails:
He asked why margins at Romano accounts were unusually high.
Gabe answered:
operational optimization.
Santini wrote:
Keep it that way.
Not proof.
Then an email three months later:
Do not let Romano audit temp IDs.
Stronger.
Why?
Santini claimed he feared losing pricing advantage.
Then:
Bianca’s secret audit surfaced.
How did they know?
Rafael had mentioned at dinner with Gabe:
“Dante’s accountant fiancée is poking around invoices.”
Rafael admitted.
Not malicious.
He was annoyed.
That information traveled.
Gabe told Hess? Hess gone.
Told Alice Doran.
Alice told Santini.
Then attack planning.
Phone records showed Santini called Nico Varga four times in week before assault.
Varga called Gabe.
Gabe photographed house service plans from vendor maintenance portal.
Then Varga hired two men.
What did Santini ask Varga to do?
Encrypted messages recovered later:
Find out what she has.
Get it before Moretti makes this criminal.
No injuries.
No headlines.
There.
Santini ordered retrieval.
Not gunfire specifically.
Still an illegal theft.
Then:
Why private dinner?
Gabe told Varga drive would be in house that evening.
How did Gabe know?
Camera clip.
Also:
Bianca’s master card present.
He had cloned previous day.
He saw opportunity.
Varga entered with armed crew.
Santini’s “no injuries” did not make armed burglary nonviolent.
Then police found Varga’s motel.
Inside:
Crestline maintenance tablet.
printed access map.
photo of Bianca holding silver drive.
three copied cards.
list of staff roles.
Sofia:
house manager / safe.
Luis:
security / alarm.
Bianca:
target / audit.
Dante:
owner / armed likely.
That last note mattered.
They expected Dante to be armed.
And came anyway.
Violence foreseeable.
Then Bianca.
Police asked if she wanted immunity for her unauthorized access in exchange for cooperation.
Her lawyer said there was no criminal conduct necessarily.
But civil privacy and employment issues.
She agreed to full cooperation without immunity demand.
Dante appreciated.
Did not fix trust.
Then she turned over:
spreadsheets.
texts.
photos.
personal notes.
One note surprised everyone:
Do not tell Dante until Rafael cleared.
That sentence revealed motive.
She was not protecting herself.
She was protecting Dante from accusing family too early.
Still paternalistic.
She had decided what he should know and when.
Then another:
If Rafael involved, Dante will make it personal.
She knew him.
Possibly true.
Still his choice.
Then Sofia learned Bianca had used her as storage without telling what drive contained.
She was furious.
“You made me hold evidence.”
Bianca said:
“I thought it was safer if you didn’t know.”
Sofia stared.
“That is what everyone says before making someone else part of their problem.”
Bianca had no answer.
Good.
Then Sofia asked:
“If Varga shot me, would you still say it was safer?”
Bianca cried.
That was not useful as permanent guilt, but the question was earned.
Then Dante met Bianca alone.
Neutral office.
He placed M-01 on table in an evidence bag? Police still held original. Can't. Use photo.
He showed her photo.
“You took this because you didn’t trust my security chief.”
“Yes.”
“Did you have evidence Luis was involved?”
“No.”
“Then you treated suspicion as permission.”
“Yes.”
Then:
“You were right about fraud.”
“Yes.”
“That doesn’t make this right.”
“I know.”
She looked exhausted.
Then Dante asked:
“Why didn’t you tell me after the threat text?”
“Because I was close.”
“To what?”
“Proof.”
“You had proof.”
“I wanted complete proof.”
There.
The trap.
Complete proof often arrives after risk has already changed.
Then:
“Would you have told me tomorrow?”
“Yes.”
He laughed softly.
Not mocking.
Sad.
“Tomorrow is where people hide decisions they already made.”
Bianca looked down.
Then she asked:
“Are we over?”
Dante did not answer quickly.
“I don’t know.”
Fair.
Unlike Sofia in previous story? Can't reference.
Then:
“I know the wedding is.”
Bianca nodded.
She removed ring.
Placed it on table.
No argument.
Then Dante said:
“I still love you.”
“I know.”
“That’s not enough.”
“No.”
They sat.
No one became villain.
No one became excused.
Then Rafael arrived for another interview.
He admitted telling Gabe about Bianca’s audit.
“I was angry she thought I was stealing.”
“Were you?” Dante asked.
Rafael looked at ledger.
“I was taking money I should have disclosed.”
“That’s not answer.”
Then:
“I don’t know when I stopped asking where the margin came from.”
That was closer.
Rafael had benefited from a system he did not design and chose not to inspect because the checks arrived.
Different from Gabe.
Different from Santini.
Still wrong.
Then Dante asked:
“Would you have told me?”
Rafael stared.
“No.”
There.
Family loyalty had hidden conflict.
Bianca’s fear of family loyalty had hidden investigation.
Both secrecy systems met in the kitchen.
And Varga came through the door they left between them.
The next breakthrough came from a boring source.
Badge reconciliation.
Crestline’s own weekly exports showed every temporary credential issued to Romano properties.
Priya compared:
badge creation.
invoice names.
actual gate scans.
time-clock punches.
The dead worker, Marco Velez, was not the only impossible identity.
Three profiles belonged to people who had left Crestline years earlier.
Two were duplicate names with altered middle initials.
One belonged to a real worker who had never set foot in Illinois.
Gabe had reused identities because the Romano system accepted vendor-uploaded rosters without independent verification.
That was a company failure too.
Dante asked his IT director:
“Why do we trust vendor names?”
“Because Crestline owns labor records.”
“Then what do we verify?”
“Hours.”
Priya looked.
“Not enough.”
New process:
vendor supplies worker identity token.
Romano verifies token is unique and active without collecting unnecessary personal data.
gate scans must reconcile to billed shifts.
exceptions reviewed.
No need for Social Security numbers in warehouse systems.
Enough verification to know a billed human exists.
Then the audit found another uncomfortable fact.
Romano managers occasionally asked Crestline to “hold headcount” on invoices even when shifts were canceled late.
Why?
Contracts had minimums.
managers wanted workers available next day.
easier than renegotiating.
Those charges were legitimate only under certain terms.
Poor descriptions made real minimum fees look like ghost payroll.
That was why Bianca’s raw anomaly total had been too high.
She had found smoke.
Some was fire.
some steam.
Then Dante asked:
“If she had come to me with the first dead name, what would I have done?”
Priya shrugged.
“Maybe ordered audit.”
“And Rafael?”
“Maybe defended him.”
“Would that be wrong?”
“Not automatically.”
There.
Bianca’s fear that Dante would make it personal was plausible.
Her solution was still wrong.
Then phone records answered another question.
Rafael had called Gabe the night Bianca asked about Marco Velez.
Duration:
eleven minutes.
Rafael said they discussed staffing placeholders.
Gabe’s notes:
Rafael nervous. Bianca digging.
That meant Rafael did alert Gabe.
Did he know that would trigger criminal response?
No evidence.
But he helped the fraud operator understand scrutiny had started.
Rafael looked devastated when shown.
“I thought he was going to clean it up.”
Dante stared.
“You warned the vendor before you warned me.”
“Yes.”
“Why?”
“Because if it was just sloppy billing, I didn’t want a family war.”
Again.
People kept choosing secrecy to avoid conflict.
Each choice created more.
Then Rafael asked:
“Do you think I caused the attack?”
Dante took time.
“No.”
Rafael looked relieved too quickly.
Dante continued:
“I think you helped Gabe know Bianca was close.”
The relief disappeared.
That was fair.
Then Sofia’s role in the safe became clearer.
Bianca had texted:
Please put silver drive in floor safe. It’s wedding audit backup.
A lie by implication.
There was no wedding audit.
Sofia would have refused if she knew it held suspected corporate fraud evidence?
Probably.
She told Bianca later:
“I’m not your evidence locker.”
Correct.
Then forensics on the silver drive found something unexpected.
A folder labeled:
Rafael_Clear?
Inside:
documents Bianca had collected that supported his legitimate consulting work.
She had not been building a case to destroy him.
She was trying to separate valid payments from questionable ones.
That helped her credibility.
Also made secrecy more frustrating.
She had already reached the point where independent counsel should have taken over.
Then Dante reviewed her notes.
One line:
Need outside forensic review before I tell D. He will believe me because he loves me. That is exactly why I need to be sure.
He sat with that.
She had not hidden because she thought he would dismiss her.
She hid because she feared he would over-believe her.
That was a different kind of control.
Still control.
Then Mara told him:
“People can have thoughtful reasons for bad process.”
He looked.
“You collecting phrases?”
“No. You keep needing them.”
Fair.
Then another document tied Santini closer.
Mesa’s finance chief emailed Paolo Santini:
Romano temp margin exposed if Ferraro reconciles badge scans.
Santini replied:
Then stop her before she gets system export.
Not:
shoot her.
But:
stop her.
Gabe then cloned M-01.
The sequence tightened.
Then Varga’s crew planning notes used a phrase:
retrieve and burn.
What?
The drive.
Destroy after copy? Why copy if burn?
They planned to extract data for Santini, then destroy physical evidence.
Bianca’s backup existed in encrypted cloud too.
They did not know.
So even successful raid would not erase audit.
Another example of people committing bigger crimes to solve a problem they did not understand.
Then Priya asked Bianca:
“Did you back up?”
“Yes.”
“Where?”
“Independent encrypted storage.”
“Who knew?”
“No one.”
“Good.”
Then:
“Why put physical drive in kitchen safe?”
Bianca sighed.
“Because I panicked.”
Not every act had a sophisticated reason.
Sometimes a forensic accountant with years of experience gets a threat text and makes a bad decision in four minutes.
That humanized without excusing.
Then Dante asked Bianca’s former supervisor from her investigations firm about her work style.
He said:
“She is excellent until she thinks management may interfere.”
“What happens then?”
“She narrows the circle.”
That fit.
“Was that useful?”
“Sometimes.”
“Dangerous?”
“Sometimes.”
Again:
traits are context-dependent.
Dante realized their relationship had rewarded Bianca’s self-reliance.
He loved that she did not need permission.
May you like
But marriage would have required knowing where independence ended and shared risk began.
They had never discussed that boundary until gunfire did it for them.
