“Quietly if nothing happened?”
“Preferably.”
“And if something did?”
The attorney paused.
“That depends.”
“No.”
The investigator closed the folder.
“That is not how this works.”
The attorney's eyes narrowed.
“You work under the monitor.”
“Yes.”
“Corporate is cooperating voluntarily beyond what the order strictly requires.”
“Good.”
“That deserves recognition.”
“No.”
The attorney stared.
The investigator continued.
“Cooperation isn't credit.”
“It is the minimum requirement after credible evidence of evidence planting.”
The room became cold.
The attorney looked toward the window.
Manhattan traffic far below.
“You believe merchandise was planted.”
“I believe one video appears to show merchandise being placed into a customer's bag.”
“Appears.”
“Yes.”
“Good.”
The attorney looked back.
“At least we're using careful language.”
The investigator smiled faintly.
“Always.”
They built the plan.
First, data.
The store provided incident reports.
Loss-prevention logs.
Shift rosters.
Internal complaints.
Police response records where available.
Vendor relationships.
Training documents.
Video-retention policies.
The investigator requested raw footage from randomly selected theft stops.
Several files were missing.
That was normal sometimes.
Storage failures happened.
Cameras malfunctioned.
Employees selected wrong timestamps.
Then she noticed something.
The missing footage clustered around incidents involving the same security manager.
Eleven missing or partially missing files.
Seven involving Black women.
Four involving other customers.
All eleven had ended with merchandise allegedly recovered from a personal bag rather than visibly concealed on camera.
She requested system logs.
Corporate IT hesitated.
The attorney intervened.
They provided them.
The footage had not simply failed.
Some files had been manually marked for deletion outside normal retention cycles.
User access logs pointed toward one security workstation.
The investigator sat back.
Now they had a real problem.
“Who can access this station?”
She asked.
The corporate IT director answered:
“Loss-prevention management.”
“How many?”
“Three people.”
“Credentials shared?”
“They shouldn't be.”
“Meaning yes?”
The director looked embarrassed.
“Potentially.”
Still not proof.
Then they reviewed civil recovery payments.
Customers accused of theft had sometimes been offered administrative settlement options even when police declined arrest.
Legal in some circumstances.
Controversial.
The store's program required independent review before any demand.
Yet the investigator found dozens of demands approved unusually quickly.
Several within twenty minutes of an incident.
One approver code appeared repeatedly.
Same security manager.
She requested his compensation structure.
No direct commission.
Good.
That eliminated one obvious motive.
Then accounting found something strange.
A third-party “loss-prevention consulting” vendor received quarterly bonuses when shrink targets were met.
The security manager had recommended the vendor two years earlier.
No direct ownership connection appeared.
The investigator kept looking.
The vendor's regional director had once been the security manager's supervisor at another retailer.
Interesting.
Still not illegal.
Then came something more troubling.
The security manager's annual performance reviews emphasized recovery rate.
Not stops.
Recovered value.
He had the highest recovery rate in the region.
Nearly double comparable stores.
Corporate celebrated him for it.