And the judge's legal team had begun asking how a completed purchase had been transformed into an allegation of a stolen credit card.
The consultant hesitated.
“There's a problem.”
The executive's smile vanished.
“What?”
“The receipt.”
The executive frowned.
“What receipt?”
“The original transaction.”
For several seconds, the room was silent.
Then the consultant explained that the fraud alert had been created only after the judge's card was approved.
Worse, the system logs appeared to show that the alert had been manually entered by a supervisor whose instructions came from the contractor.
The executive stood.
“Delete it.”
The consultant went quiet.
The executive repeated himself.
“I said get rid of the alert.”
The consultant swallowed.
“We can't just erase the transaction logs.”
The executive's face darkened.
“Then find somebody who can.”
He had no idea that another employee was listening through the open conference-room door.
A woman who had spent eight years maintaining the company's compliance records.
A woman who had grown increasingly uncomfortable with how suspicious-customer alerts were being created.
And a woman who would soon become the most important witness in the case.
The compliance officer had been working late when she overheard the conversation.
At first, she assumed the executive was discussing an ordinary records-management problem.
Then she heard him order someone to delete the security alert.
She stopped typing.
The office had become quiet after most employees left, and the conference-room door stood partly open.
The compliance officer could hear every word.
She heard the consultant explain that the transaction logs were stored in more than one system.
She heard the executive demand that the records disappear.
And she heard the consultant warn that deleting evidence after an official preservation request could create another serious problem.
The executive responded with an angry insult.
Then the call ended.
The compliance officer sat very still.
She was a woman in her early fifties who had spent most of her career working in corporate audits and regulatory compliance.
She wasn't wealthy.
She wasn't politically connected.
And she wasn't interested in becoming a public figure.
She liked quiet work.
Accurate records.
Clear procedures.
And knowing that when she signed a compliance report, the information underneath it was reliable.
Recently, that had become increasingly difficult.
The private security company had expanded rapidly.
Its executives described the growth as evidence that retailers trusted its technology.
But the compliance officer had noticed unusual changes in how the company counted suspicious activity.
In earlier years, alerts generally required a documented incident.