The analyst looked toward the eighty-six-million-dollar figure.
For a moment, she considered obeying.
Then she remembered the foundation's financial controls.
The policy was clear.
Unusual or potentially unauthorized transactions needed to be reported through independent channels.
Especially when someone tried to discourage questions.
She thanked the CFO.
Ended the call.
And opened the foundation's emergency reporting procedure.
By 2:29 a.m., the first warning had been sent.
The analyst didn't know whether anyone would read her report before morning.
The foundation's emergency procedure routed unusual financial activity to an independent trustee, the external audit contact, and a designated executive security officer. It also generated an alert for the chair when a transaction exceeded the foundation's established reporting threshold.
She completed the form carefully.
She included the beneficiary name, transaction reference, creation time, and the lack of matching board authorization.
Then she attached screenshots showing the instruction's status.
The analyst didn't accuse anyone of theft.
She couldn't know whether the transfer was fraudulent.
There might have been a legitimate explanation buried in correspondence she hadn't received.
But she knew the transaction hadn't followed the ordinary process.
At 2:34 a.m., the system confirmed her report had been accepted.
She sat back.
For several seconds, she stared at the screen.
Then she noticed something else.
The original transaction entry had changed.
A note now claimed that all necessary foundation authorizations had been verified by the bank's institutional client team.
She opened the attached document.
At the bottom was the chair's signature.
The analyst zoomed in.
It looked authentic.
But the authorization date was Tuesday afternoon, while the CEO had been attending rehearsals and preparing for the benefit.
That alone didn't prove the document was false.
People signed documents while traveling.
But the bank's record also claimed that a physical identity-verification meeting had occurred at its downtown branch.
The analyst checked the time.
4:12 p.m.
She remembered receiving a photograph from the event's preparation team at almost exactly that moment.
The CEO had been standing inside the fitting studio, wearing the unfinished silver dress.
The analyst's stomach tightened.
Could the chair have visited the bank earlier?
Possibly.
But a signed document showing in-person verification during a time when the chair was elsewhere demanded an explanation.
She added the discrepancy to her report.
Then she saved the original file.
She didn't realize that this second observation would later become the key to proving the transfer had been constructed around a fabricated authorization.
At 5:51 a.m., the CEO returned to her penthouse apartment overlooking the Chicago River.