I thanked my boss for the $2,000 bonus in my account. He shut his office door, sat down slowly, and said, “That bonus was $95,000. Someone’s been skimming your payroll for months.” The fluorescent lights in Michael Brennan’s office suddenly felt too bright, like I was under interrogation.
I’d walked in here at 3:45 p.m. on a Friday afternoon, expecting a quick thank you and have a good weekend conversation. Instead, my boss, the regional director of operations for Techflow Solutions, was looking at me with an expression I’d never seen before.
Not anger, not disappointment, something worse. Pity mixed with barely controlled rage. His hand was still on the mouse, frozen over whatever he’d been looking at on his computer screen.
The door click behind me sounded too loud, too final, like a cell door locking. I laughed. Actually laughed, because what else do you do when someone tells you something so absurd your brain can’t process it?
What? No, the bonus was 2,000. I saw it in my account this morning.
I came to thank you for it. My voice sounded strange to my own ears. Too high, too defensive.
Michael didn’t smile. He turned his monitor toward me. The screen showed a payroll summary with my name at the top.
Employee ID 4729. Hire date January 2019. The bonus line read, “Performance bonus Q12024, $95,000.
Approved by M. Brennan. Processed March th, 2024.
Net deposit after taxes, $61,340. My stomach dropped through the floor. I’d received $1,287.
after taxes that tracked with a $2,000 bonus, not a $95,000 one. The numbers on Michael’s screen blurred and refocused. I reached out to steady myself against his desk.
That’s not possible. I only got 2,000. Check my bank account.
I can show you right now. I was already pulling out my phone, fingers shaking as I opened my banking app. The deposit from Techflow Payroll dated March th showed exactly $1,287.
I turned my phone toward Michael. He glanced at it, then back to his screen. I know what you received,” Michael said quietly.
“That’s the problem. You should have received $61,000. Someone intercepted the difference.
Someone with access to our payroll system has been routing portions of your compensation to another account.” He pulled up another window. This one showing a transaction log I couldn’t fully understand. I only discovered this 2 hours ago when I was reviewing our quarterly financials.
Your bonus was approved at 95,000 because you single-handedly saved the Meridian contract. You know what that account is worth to us? 8 million annually.
You deserved every penny of that bonus. He paused, his jaw tight. But $93,000 never reached you.
It went somewhere else. I’d been working as a senior solutions architect at Techflow Solutions for 5 years, ever since I’d graduated with my masters in computer science from Georgia Tech. Techflow was a midsized IT consulting firm based in Atlanta, about 400 employees specializing in enterprise software implementation for manufacturing companies.
The work was demanding but rewarding, and I’d built a reputation as the guy who could rescue failing projects. The Meridian manufacturing account had been a disaster when I inherited it last November. Their previous architect had quit mid-implementation, leaving behind spaghetti code and angry clients.
I’d spent four months working 70-hour weeks rebuilding their entire inventory management system from scratch, training their staff, and turning what should have been a lawsuit into a glowing testimonial. When I saw the $2,000 bonus hit my account on Friday morning, I’d been grateful, but not surprised. Our company did quarterly performance bonuses, and I’d received similar amounts before.
2,000 felt appropriate for a good quarter. I texted my girlfriend Alicia that we could splurge on that weekend trip to Savannah she’d been wanting. I’d stopped by Michael’s office specifically to thank him because that’s what you do.
You show gratitude. Now Michael was telling me I should have received nearly 50 times that amount and my gratitude felt like evidence of how badly I’d been robbed. Who has access to payroll?
I asked my voice steadier now. The initial shock was giving way to something colder, harder. Someone had stolen from me.
Someone I worked with. Someone I probably saw every day had been stealing my money. Michael stood up, walked to his window overlooking the parking lot.
That’s what we need to figure out. Officially, only three people have full payroll access. Dorothy in HR, Gerald in accounting, and me.
But there are also system administrators who maintain the software, contractors who handle IT support, and various people with partial access for different functions. He turned back to face me. I’ve already put in a call to our CFO.
He’s bringing in a forensic accountant. We’re also going to need to involve law enforcement. The word law enforcement made everything feel suddenly terribly real.
This wasn’t just a mistake or a glitch. This was theft. This was fraud.
This was someone deliberately, systematically stealing from me. My hands were shaking again. I sat down in the chair across from Michael’s desk without being invited.
How long has this been happening? You said months. Michael’s expression darkened.
I don’t know yet. The bonus is what caught my attention because the amount was large enough to create a discrepancy I noticed during my quarterly review. But if someone has been skimming your regular paycheck, bonuses, raises, it could have been going on since you started here.
He pulled up another document. Your base salary is 98,000, but if I’m seeing what I think I’m seeing, you might have been receiving payments based on a lower amount. I pulled up my payubs on my phone, something I rarely looked at because I had direct deposit and generally just checked my account balance.
The most recent stub from March th showed my gross pay as $3,76923 for the twoe period. I did the math quickly in my head. 26 pay periods per year times $3,769 equals roughly $98,000 annually.
That tracked with my salary. My regular paychecks look normal, I said, showing Michael the stub. He frowned, zoomed in on the numbers.
Maybe they only hit the bonuses, or maybe the skimming is more sophisticated than I thought. He picked up his office phone, dialed an extension. Dorothy, it’s Michael.
I need you to pull every payment record for employee 4729 going back to his hire date. Every paycheck, every bonus, every reimbursement. Yes, immediately.
No, I can’t explain right now. Just do it. Dorothy Guian had been Techflow’s HR director for 8 years, longer than I’d been with the company.
She was efficient, professional, and had always been pleasant in our limited interactions. The thought that she might be the one stealing from me made my skin crawl. But Michael had said three people had access.
Dorothy, Gerald Foster from accounting, and Michael himself. I trusted Michael. He was the one who discovered the theft.
That left Dorothy or Gerald or someone else entirely. someone with system access I didn’t know about. The paranoia was already starting.
That creeping suspicion that made everyone around me feel potentially guilty. Michael hung up the phone. She’s pulling the records now.
While we wait, I need to ask you something, and I need you to be completely honest with me. His tone made me nervous. Have you shared your employee login credentials with anyone?
Given anyone access to your employee portal? I shook my head. No.
Why would I? Michael shrugged. Identity theft, fishing scams.
Sometimes employees get tricked into giving up their passwords. If someone had your login, they could potentially have altered your direct deposit information without you knowing. That thought hadn’t occurred to me, and it opened up terrifying new possibilities.
What if this wasn’t an inside job? What if my identity had been compromised more broadly? Over the next 3 hours, Michael’s office became a war room.
Dorothy arrived with printed payroll records, her expression confused and concerned. Gerald joined us 20 minutes later, summoned by Michael’s increasingly tur phone calls. The CFO, Thomas Whitmore, drove in from his home in Buckhead, arriving at 6:30 p.m.
with a laptop and a grim expression. We spread documents across Michael’s conference table, comparing what the company had paid out versus what I’d actually received. The picture that emerged was worse than I’d imagined.
The bonus theft was just the tip of the iceberg. Gerald, a meticulous man in his early s who’d been with Techflow for 12 years, pulled up historical payment data and walked us through what he was seeing. Your salary was increased to 98,000 in January 2023,” he said, pointing to an approval form with Michael’s signature.
“But looking at your actual deposits, you’ve been receiving payments consistent with an $82,000 salary.” He turned his laptop toward me. The numbers were there in black and white. Every paycheck, I’d been shorted roughly $600.
===== PART 2 =====
26 pay periods per year, that was $15,600 annually stolen from my regular salary alone. For 15 months, that totaled $19,500. Then there were the bonuses.
I’d received four quarterly performance bonuses since my raise. Each one showing as $2,000 in my account. But Gerald showed me the approved amounts.
$12,000 for Q223, $18,000 for Q32023, $8,500 for Q42023, and the recent $95,000 for Q12024. I should have received $133,500 in bonuses. I’d received $8,000.
Someone had stolen $125,500 from my bonuses. Combined with the salary skimming, the total theft over 15 months was approximately $145,000. I felt sick.
That was more than an entire year’s salary. That was money I could have used for a down payment on a house, for paying off my student loans, for building an actual financial future instead of living paycheck to paycheck like I’d been doing. How is this even possible?
I asked, my voice rough. Don’t we have controls? Don’t bonuses get verified?
Thomas, the CFO, had been silent up to this point, but now he spoke with barely controlled anger. We have controls. Bonuses over $10,000 require dual approval.
Mine and the department heads. I signed off on your $95,000 bonus personally. He pulled up an email dated March nd showing his electronic approval.
The payment was processed correctly on our end. The issue is what happened after it entered the payroll system. He looked at Dorothy.
You process the actual payments, correct? Dorothy’s face had gone pale. I initiate the payments based on the approved amounts in the system, but I don’t manually enter bank account details for every employee.
That’s automated. The system pulls the direct deposit information from each employees profile. She pulled up her own laptop, logged into the payroll software.
Let me check something. Her fingers flew across the keyboard, navigating through screens. Then she stopped.
Her eyes widened. Oh my god. She turned her laptop toward us.
My employee profile was displayed, showing my personal information, salary details, and banking information. Except the banking information showed two accounts. my primary account, the one I’d set up when I started, and a second account labeled bonus/commission override with a different routing number and account number.
I never set up a second account, I said immediately. I don’t even know what that is. Thomas leaned in, examining the screen.
When was this added? Dorothy clicked through the change history. February th, 2023.
Modified by user d.guan. She looked up, her expression stricken. That’s my user ID, but I didn’t do this.
I swear to God, I didn’t add this account. The room went silent. Either Dorothy was lying or someone had used her credentials to make the change.
Michael stood up. We’re done speculating. Thomas, call your forensic accountant contact.
I want someone here first thing Monday morning. Dorothy, Gerald, I need both of you to document everything you’ve touched related to this employees payroll for the past 2 years. Every approval, every payment, every system access.
===== PART 3 =====
I want timestamps, IP addresses, everything. Gerald nodded and left quickly. Dorothy remained seated, tears forming in her eyes.
Michael, I would never steal from an employee. You have to believe me. Michael’s expression softened slightly.
I’m not accusing you, Dorothy, but your credentials were used to make unauthorized changes. Either you did it or someone else is using your access. Either way, we need to figure out what happened.
After Dorothy left, Thomas pulled me aside. I’m going to need you to file a police report. This is theft over $100,000.
That’s a felony in Georgia. The company will cooperate fully with any investigation, but you’re the victim here. You need to be the one to initiate the criminal complaint.
I drove home in a days. It was after 8:00 p.m. The sun already set.
Atlanta traffic finally thinned out. My hands gripped the steering wheel so tight my knuckles were white. Someone had stolen $145,000 from me.
Someone had systematically deliberately diverted my money into their own account for over a year, and I’d never noticed. I’d been grateful for the scraps they left me, thanking my boss for a $2,000 bonus when I should have received $95,000. The humiliation burned almost as hot as the anger.
How had I not noticed? How had I been so oblivious? The answer was uncomfortable.
I trusted the system. I trusted that when my paycheck hit my account, it was the right amount. I trusted that the company I’d given 5 years of my life to was treating me fairly.
I’d never thought to verify my payubs against my offer letter to cross-check my bonuses against my performance reviews. I just assumed everything was correct, and someone had exploited that trust to rob me blind. When I got home to my apartment, a modest one-bedroom in Virginia Highland that I could barely afford, I pulled out my original offer letter from 2019.
Starting salary $72,000. I’d received raises in 2020, 2021, and 2023, documented in emails from Michael and HR. My current salary should have been $98,000, but I’d been receiving $82,000.
The missing money accumulated over 15 months would have been enough to move out of this cramped apartment, maybe buy a small house, start building equity instead of paying rent. I called Alicia. She answered on the second ring, her voice bright.
Hey, are you still at work? I was thinking we could grab dinner at that tie place you like. I couldn’t even respond for a moment, the words stuck in my throat.
Babe, what’s wrong? Her tone shifted immediately to concern. I told her everything, the bonus that should have been $95,000, the salary I’d been shorted for over a year, the stolen $145,000.
She was silent for a long moment, then said something I wasn’t expecting. I knew something was wrong. My heart skipped.
What do you mean? Alicia took a breath. Last year when you got that promotion and the raise, you said you’d finally be making six figures.
But your lifestyle didn’t change. You were still stressed about money, still worrying about student loans, still driving that 15-year-old Camry. I thought maybe the raise wasn’t as much as you thought.
Or maybe you were saving aggressively, but it didn’t make sense. You should have had more breathing room financially. She was right.
After my raise to $98,000 in January 2023, I should have been comfortable. Not wealthy, but stable. Instead, I’d been scraping by, stressed about every unexpected expense, unable to save more than a few hundred per month.
I’d thought I was bad at budgeting, bad with money. Turns out, I’d been fine. Someone else had been taking my money before I ever saw it.
I filed the police report on Saturday morning at the Atlanta Police Department’s White Collar Crimes Division. The detective who took my statement was Veronica Albbright, 22 years on the force, specializing in financial crimes and fraud. She was in her late s, sharpeyed with the kind of intense focus that made me feel like she was cataloging every detail.
I walked her through the timeline, showing her the payroll documents Thomas had emailed me, my bank statements, the screenshots of the fraudulent account added to my employee profile. Detective Albbright took notes in a worn leather notebook, occasionally asking clarifying questions. So, this secondary account, she said, tapping her pen against the page.
The one labeled bonus/commission override, do you have any information about where it actually leads? Bank name, account holder. I shook my head.
The company’s CFO is working with a forensic accountant to trace it. They said they’d have more information by Monday. Albright nodded.
Good. I’ll coordinate with them, but I need you to understand something. This is going to take time.
Financial fraud investigations, especially ones involving internal corporate systems, can take months to untangle. We need to build a case that proves not just that money was stolen, but who stole it and how. That requires documentation, expert testimony, digital forensics.
Months. The word settled over me like a weight. I’d been robbed of $145,000 and justice would take months.
In the meantime, what? I kept working at Techflow, knowing someone there was a thief. I kept showing up to the office, making small talk with people who might have stolen from me.
Albbright must have seen something in my expression because she softened slightly. I know it’s frustrating, but the good news is whoever did this left a digital trail. Bank accounts, system access logs, timestamps, financial crimes are actually easier to prosecute than a lot of other cases because money leaves tracks.
We’ll find them. The forensic accountant arrived at Techflow’s office Monday morning at 9:00 a.m. sharp.
Her name was Patricia Louu, CPA, CF, 20 years experience in fraud examination and forensic accounting. She set up in one of the conference rooms with three laptops, a printer, and what looked like a portable server. Thomas introduced me to her before her first meeting with the executive team.
“Ms Lou is one of the best in the Southeast,” he said. “If there’s evidence of fraud in our systems, she’ll find it.” Patricia shook my hand with a firm, professional grip. I’m sorry this happened to you.
I’ve reviewed the preliminary documents. This was sophisticated. Whoever did this knew exactly how your payroll system works and exploited a weakness in your direct deposit override protocols.
Over the next 3 days, Patricia essentially took over Techflow’s accounting department. She interviewed Dorothy, Gerald, and every other employee with any level of payroll system access. She pulled system logs going back 2 years, tracking every login, every change, every transaction.
She requested bank statements from the company, from me, and subpoenaed records from the bank where the fraudulent account was held. I tried to work, tried to focus on my projects, but I was useless. I kept checking my phone for updates, kept refreshing my email, kept looking around the office, wondering which of my co-workers was a thief.
On Wednesday afternoon, Patricia called an emergency meeting. Present were me, Michael, Thomas, Dorothy, Gerald, and Techflow’s attorney, Richard Nolles, who’d been brought in to advise on the legal implications. Patricia stood at the head of the conference table with her laptop open.
I’ve traced the fraudulent account, she said without preamble. The bonus/commission override account that was added to the employees profile in February 2023 belongs to a Coastal Bank checking account opened in January 2023. The account is registered to a Veronica Albbright.
My brain shortcircuited. What? No, that’s the detective investigating this case.
Patricia held up a hand. Different person. There are 127 Veronica Albbrightes in Georgia.
According to public records, this particular Veronica Albbright is actually an alias. The social security number used to open the account is fake. The address is a UPS store in Marietta, but the account has received $145,87329 in deposits over the past 15 months.
All from Techflow Solutions payroll, all corresponding to the amounts that should have gone to you. She pulled up a bank statement showing the deposits, my bonuses, my salary, my money flowing into a ghost account under a fake name. Who opened the account?
Thomas demanded. Patricia clicked to another screen. The account was opened online using forged identity documents.
The bank’s fraud department is cooperating with Detective Albbright’s investigation. They’ve provided the IP address used to open the account and conduct transactions. That IP address belongs to a residential internet connection in Decatur, Georgia.
She paused for effect. The same address where Dorothy Guian lives. The room exploded.
Dorothy stood up so fast her chair fell backward. That’s insane. I didn’t do this.
Someone must have hacked my internet, my computer, something. I would never steal from anyone. Michael held up his hands.
Dorothy, sit down. Let Patricia finish. Dorothy sat, her face flushed, tears streaming down her face.
Patricia continued, her voice neutral and professional. The IP address alone isn’t conclusive. As Ms.
Enuan says, it could be spoofed or accessed through a compromised network. However, the system logs tell a more complete story. The change to add the fraudulent account to the employee profile was made on February th, 2023 at 11:47 p.m.
The login used was Dean Guian’s credentials. The IP address was Dorothy’s home connection. The computer MAC address matches Dorothy’s work laptop, which she’s allowed to take home per company policy.
Dorothy’s voice was a whisper. I didn’t do it. I swear on my children’s lives, I didn’t do this.
Patricia wasn’t done. The pattern of access is consistent with someone who knows the payroll schedule intimately. Changes to the direct deposit override were made within hours of bonus approvals, ensuring the fraudulent account would capture the maximum amount.
The salary skimming was more subtle, implemented through a formula in the payroll software that calculated the employees net pay based on a salary $16,000 lower than his actual salary with the difference routed to the secondary account. Richard the attorney leaned forward. So, whoever did this had deep knowledge of the payroll system and had administrative access.
Patricia nodded. Yes. And according to the access logs, only three people have that level of access.
Dorothian, Gerald Foster, and Michael Brennan. However, Gerald’s access logs show no activity during the relevant time periods, and his IP addresses are all from the office or his home in Alpharetta. Michael Brennan’s access shows normal executive review activity, but no modifications to employee profiles or direct deposit information.
She looked at Dorothy. Dorothy’s account shows extensive activity, including the specific changes that facilitated the theft. The evidence was damning.
Dorothy was crying openly now, her hands shaking. I don’t understand. I didn’t do this.
Why would I do this? I make $65,000 a year. I’m not hurting for money.
Thomas’s voice was cold. Your bank records show deposits totaling $145,000 over 15 months. I’d say you are significantly better off financially than you were 2 years ago.
Dorothy looked up, confused. What deposits? I don’t have any extra money.
You can check my accounts. I’m barely breaking even every month. That stopped everyone.
Patricia tilted her head. You’re saying you don’t have the stolen funds? Dorothy shook her head frantically.
I don’t have anything. I have my salary direct deposited to my Bank of America checking account. That’s it.
Patricia pulled up another document. Bank records for Dorothian show a primary checking account at Bank of America receiving bi-weekly payroll deposits of approximately $2,200 consistent with a $65,000 salary after taxes. No unusual deposits, no large transfers, no evidence of the stolen funds.
She clicked to another screen. However, I also ran a search for bank accounts opened using Dorothy’s home address. In addition to her Bank of America account, there’s the Coastal Bank account under the alias Veronica Albbright.
And a third account at Sunrust opened in February 2023 under Dorothy’s actual name, but with a slightly different social security number, a single-digit transposition. The room went silent. Thomas spoke first.
Someone opened a bank account in Dorothy’s name. Patricia nodded using her home address, a fake SS SN, and forged identity documents. That account has received wire transfers totaling $82,000 from the Coastal Bank account, the one receiving the stolen payroll funds.
So, the money trail goes techflow payroll to Coastal Bank alias account, then to Sunrust account in Dorothy’s name, then withdrawn in cash over time. She looked at Dorothy. Have you been making large cash withdrawals recently?
Dorothy shook her head, looking utterly lost. I don’t even have a Sunrust account. I’ve only bked with Bank of America for 15 years.
Michael’s expression had shifted from anger to confusion. So, either Dorothy is an incredibly sophisticated criminal who’s pretending not to know about these accounts, or someone is setting her up. Patricia pulled off her glasses, rubbed her eyes.
That’s what I thought initially, but then I looked deeper. The Sunrust accounts debit card has been used at several locations in the Decatur area, gas stations, grocery stores, restaurants. I pulled surveillance footage from three of those locations through cooperation with Detective Albbright’s investigation.
She turned her laptop toward us, played a video. The footage showed someone using an ATM withdrawing cash. The person was wearing a baseball cap and sunglasses, but the build and posture looked wrong for Dorothy.
Too tall, too masculine. Patricia paused the video, zoomed in. This is from March th at a Shell station in Decator.
Cash withdrawal of $800 from the Sunrust account. Notice the height against the ATM. This person is approximately 5’10.
Dorothy is 5’4. She played another video. This is from April rd at a Kroger.
$400 withdrawal. Same height discrepancy. A third video.
April nd, Texico. $600. In this one, you can see the person’s hand.
Male based on hand size and shape. Wedding ring on the left hand. Dorothy’s eyes widened.
Is that is that Frank? Her voice was barely audible. Patricia didn’t answer.
Just played a fourth video. This one from a restaurant parking lot. The person getting into a car removing the baseball cap for just a moment.
The face was partially obscured, but visible enough. Frank Nuan, Dorothy’s husband. Dorothy made a sound like she’d been punched.
No, no, Frank wouldn’t. He’s my husband. We’ve been married for 19 years.
He wouldn’t steal from my company. He wouldn’t frame me. Thomas’s voice was hard.
Where does Frank work? Dorothy’s voice was mechanical. Shock setting in.
He’s a software engineer. Works for Dataore Solutions. Makes 90,000 a year.
Patricia pulled up another document. Frank Naguan was laid off from Dataore in November 2022. According to unemployment records, he collected benefits through April 2023, then went off the roles.
No record of employment since. Dorothy’s face went white. That’s not possible.
He goes to work every morning. He comes home every evening. He complains about his projects, his co-workers.
He’s been working. Michael closed his eyes. Dorothy, when did you tell Frank about your payroll system access?
Dorothy looked at him, tears streaming down her face. He helped me set up my work laptop at home in 2020 during CO. He’s good with computers.
He showed me how to use the VPN, how to access the system remotely. Patricia made a note. Did he have your login credentials?
Dorothy nodded slowly. We share passwords. He knows all my loginins.
We’ve always done that. We’re married. We trust each other.
The picture was becoming clear, and it was ugly. Frank Ninguan, unemployed since November 2022, had used his wife’s payroll access to set up a sophisticated theft scheme. He’d created a fake bank account under an alias, added it to my employee profile as a direct deposit override, and systematically stolen over $145,000 from my paychecks and bonuses.
He then transferred the money to a second account in his wife’s name with a fake SSN, withdrawn it as cash, and spent it while Dorothy worked, and had no idea her husband was committing felonies using her credentials. All the evidence pointed to Dorothy because Frank had deliberately designed it that way. If caught, she’d take the fall.
His wife, the mother of his children, set up to go to prison for his crimes. Dorothy called Frank from the conference room with Detective Albbright listening in via speaker phone and Patricia recording. Dorothy’s voice shook as she asked, “Frank, honey, where are you right now?” There was a pause.
At work. Why? His voice sounded normal.
Casual. What’s the address of your office? I need to send you something.
Another pause, longer this time. Why are you asking me this? Dorothy’s voice hardened.
Because I’m sitting in a conference room with my boss, our CFO, a forensic accountant, and a detective who’s about to issue a warrant for your arrest. They have bank records, surveillance footage, and system logs showing you’ve been stealing from my company using my credentials. So, I’ll ask you one more time.
Where are you? The silence on the other end stretched so long I thought he’d hung up. Then Frank’s voice came back different now.
Cold. I’m at home. I’ve been home all day.
I haven’t worked in 6 months. Dorothy, you know that. Dorothy’s confusion was genuine.
What? No, you leave for work every morning. Frank laughed bitter.
I leave the house every morning because I can’t stand to sit here all day unemployed. I go to coffee shops, libraries, parks, anywhere but home. And while I’m out, I’ve been trying to figure out how to tell you that we’re broke, that I lost my job, that we can’t afford our mortgage on your salary alone.
He paused. So yeah, I took some money from your company, from someone who could afford it, someone making six figures who wouldn’t even notice a few thousand missing. Detective Albbright spoke for the first time.
Mr. Nguian, this is Detective Veronica Albbright with the Atlanta Police Department. I need you to understand that you’ve just confessed to theft over $100,000, wire fraud, and identity theft.
These are federal crimes. I have officers on the way to your location now. I’m advising you not to resist arrest.
Frank’s voice cracked. Dorothy, I’m sorry. I was trying to keep us afloat.
I was going to pay it back when I found another job. I didn’t think anyone would notice. Dorothy hung up the phone and put her head in her hands, sobbing.
Frank Nonguan was arrested at his home in Decar at 4:37 p.m. that Wednesday afternoon. The charges were extensive.
Felony theft, wire fraud, identity theft, computer fraud, and forgery. Because the theft exceeded $100,000 and crossed state lines through the banking system, the FBI became involved. Special Agent Kenneth Draper, Whitecollar Crime Division, took over the case from Detective Albbright.
The investigation expanded rapidly. Agents seized Frank’s computer, finding detailed records of the theft, including spreadsheets tracking the stolen amounts, research into TechFlow’s payroll system, and tutorials on creating fake identity documents. The most damning evidence was a folder on Frank’s desktop labeled retirement fund containing bank statements from the Coastal and Sunrust accounts showing the full $145,000 theft and subsequent cash withdrawals.
Frank had been methodical, documenting everything, perhaps planning to eventually claim it as legitimate income or perhaps just unable to resist the accountant’s impulse to track his own crime. He’d spent approximately $118,000 of the stolen money over 15 months. Cash withdrawals that funded his daily expenses while pretending to be employed.
upgrades to their home that Dorothy had thought were financed through Frank’s bonuses and a boat he’d told Dorothy was a gift from his parents. The remaining $27,000 was still in the Sun Trust account, which was immediately frozen by the FBI. The federal prosecutor, assistant US attorney Michelle Carver, 23 years with the DOJ, specialized in white collar crimes, explained the case to me in her office downtown.
Mr. Inguian is looking at 20 to 30 years in federal prison if convicted on all counts. The theft alone is a decade.
Add in the wire fraud, the identity theft, the use of interstate banking systems, and we can stack the charges significantly. She leaned back in her chair. He’s already trying to negotiate a plea deal.
His attorney is arguing for reduced charges in exchange for full restitution and cooperation. I sat across from her, still processing everything. What about Dorothy?
She had no idea what he was doing. Carver shook her head. We’ve investigated thoroughly.
Dorothy Guian is a victim here, same as you. Her husband used her credentials without her knowledge, committed crimes in her name, and set her up to take the fall if discovered. She’s been cooperative with the investigation, and won’t face charges.
She pulled out a document. However, we do need your input on something. As the victim, you have the right to provide a statement regarding sentencing recommendations.
You can advocate for leniency or push for maximum penalties. What happens to Franken partially depends on what you want to see happen. What did I want?
I’d lost $145,000. Money I’d earned through long hours and hard work. Money that would have changed my life, given me financial security I’d never had.
Frank Naguan had stolen that from me, stolen my future. And he’d done it casually, methodically, without remorse until he was caught. He justified it by saying I could afford it and wouldn’t notice as if being robbed was okay as long as the victim didn’t immediately realize it.
But I also knew Frank had a family, Dorothy and two teenage kids who were about to watch their father go to prison. kids who’ done nothing wrong except have a father who was a criminal. I want full restitution, I said finally.
Every penny plus interest and penalties. I want it documented in court that what he did was theft, not some justified redistribution. But beyond that, I’ll leave sentencing to the judge.
I’m not going to advocate for him being locked up forever, but I’m not going to ask for leniency either. He’s an adult. He made choices.
He can face the consequences. Carver nodded, made a note. That’s fair.
For what it’s worth, between the frozen account and asset seizure, we’ll recover about 35,000 immediately. The rest will come through wage garnishment and liquidation of Frank’s assets. You won’t get everything back overnight, but you will get it back eventually.
The trial didn’t happen. 6 weeks after Frank’s arrest, his attorney negotiated a plea deal. Frank plead guilty to wire fraud and theft with the other charges dropped in exchange for his cooperation and an agreement to full restitution.
The sentencing hearing was scheduled for September. In the meantime, Techflow conducted its own internal investigation, brought in outside consultants to audit their entire payroll system, and implemented new security protocols. Dorothy was placed on paid administrative leave during the investigation, then eventually returned to work with the understanding that she was a victim, not a perpetrator.
She filed for divorce from Frank within a month of his arrest. Michael called me into his office on a Friday afternoon in July, three months after he’d first shown me that payroll document revealing the theft. I wanted to give you an update on restitution, he said pulling up a spreadsheet.
The FBI recovered 27,000 from the frozen account. Frank’s attorney has agreed to liquidate assets, including the boat and some other property, which should net another 40,000. That leaves 78,000 still owed.
He paused. Techflow’s insurance is covering 60,000 of that as a liability claim since the theft occurred through our systems. Frank will be responsible for the remaining $18,000 through wage garnishment from whatever job he gets after prison.
I did the math. I’d get back $127,000 of the $145,000 stolen. Not perfect, but better than I’d hoped.
Michael continued, “There’s one more thing. The company is issuing you a formal apology and a settlement payment of $30,000 for the distress this caused and our failure to detect the theft sooner. We’re also fast-tracking your promotion to principal architect, which comes with a salary increased to 115,000.” He slid a document across the desk.
I need you to sign this agreement acknowledging the settlement and agreeing not to pursue additional legal action against Techflow. I read through the agreement carefully, a habit I developed after learning the hard way that documents don’t always mean what you think they mean. The settlement was fair.
Techflow hadn’t committed the theft, but they’d failed to prevent it, and they were taking responsibility. I signed. Michael shook my hand.
I’m sorry this happened. You deserved better from us, from the system, from everything. But I’m glad we caught it.
I’m glad we’re making it right. I nodded. Me, too.
The sentencing hearing happened on a Thursday morning in September at the federal courthouse downtown. I sat in the gallery with Alicia, watching as Frank Ninguan stood before Judge Leonard Harper, a federal judge with 32 years on the bench. Frank looked smaller than I remembered from his arrest photos, diminished by an orange jumpsuit and handcuffs.
His attorney read a prepared statement expressing remorse, explaining Frank’s financial desperation after his job loss, asking for leniency. Then the prosecutor presented the facts. $145,000 stolen over 15 months, sophisticated scheme, attempt to frame his wife, lack of real remorse until caught.
Judge Harper listened to everything, reviewed the presentencing report, then addressed Frank directly. “Mr. Inguan, you didn’t steal to feed your family.
You stole to maintain a lifestyle you could no longer afford. You used your wife’s credentials to commit crimes, set her up to take the fall, and showed no remorse until law enforcement was closing in. You stole from a hardworking employee who trusted his employer, and you did it systematically over more than a year.” He paused.
I’m sentencing you to 8 years in federal prison, followed by 3 years supervised release. You’ll also pay full restitution of $145,000 plus interest and penalties. You’re fortunate the government agreed to drop the identity theft charges, which would have added years to your sentence.
8 years. Frank would be 56 when he got out. His kids grown, his marriage destroyed, his career gone.
I felt no satisfaction in watching him led away by federal marshals. Just a hollow sense that justice had been done, but nothing had really been fixed. The money would come back eventually, but the 15 months of financial stress I’d endured, the opportunities I’d missed, the trust I’d lost in systems and people, none of that could be restored through restitution and prison time.
Outside the courthouse, Alicia took my hand. How do you feel? I thought about that.
Relieved, angry, tired, all of it. She squeezed my hand. You did the right thing.
You reported it. You cooperated with the investigation. You didn’t let him get away with it.
I nodded. I keep thinking about what would have happened if Michael hadn’t noticed the bonus discrepancy. How much more could Frank have stolen?
How long before I noticed? Alicia leaned her head against my shoulder. But he did notice.
And you did find out. And now it’s over. 3 months later, I bought a house.
Not a mansion, just a modest three-bedroom in Brook Haven with a small yard and a mortgage I could actually afford with my new salary. The down payment came from the insurance recovery and tech flow settlement. I moved in on a Saturday with help from friends, including some co-workers who’d stood by me through the investigation.
Michael came by with a bottle of bourbon and a housewarming gift, a framed print that said, “Trust, but verify,” in elaborate calligraphy. I hung it in my home office, a reminder of the most expensive lesson I’d ever learned. I still work at Techflow, still do the same job, now with a better title and better pay.
Dorothy eventually left the company, unable to handle the stigma of being associated with the theft, even though she was a victim. We had coffee once, a few months after Frank’s sentencing, and she apologized for what her husband had done. I told her she had nothing to apologize for.
She’d been betrayed worse than I had by someone who was supposed to protect her. Last I heard, she’d moved to North Carolina to be closer to her sister, started over somewhere nobody knew her story. I check my payubs now, every single one.
I verify the amounts against my salary, cross reference my bonuses against approval emails, monitor my bank accounts obsessively. Alicia says I’ve become paranoid about money. Maybe I have, but I’ve also become someone who doesn’t just trust that systems work correctly or that people are honest.
Trust but verify. Ronald Reagan said it about Soviet nuclear disarmament, but it applies just as well to payroll, to banking, to everything where your security depends on someone else doing their job correctly. The final restitution payment came through last month.
$18,000 from Frank’s wage garnishment transferred from whatever job he found after being released on parole. It’s been 5 years since he stole from me. From 5 years of waiting, of watching the slow machinery of justice grind toward restitution, the total I’ve recovered, including insurance and tech flow settlement, is $175,000, which is more than the original $145,000 stolen once you factor in interest and penalties.
I put it into index funds and a retirement account, building the future Frank tried to steal from me. Sometimes I wonder what Frank’s thinking now, living in a halfway house in suburban Atlanta, working some low-level tech support job, sending $1,800 a month to me as restitution. Does he regret it?
Does he understand what he took wasn’t just money, but trust, security, peace of mind? Probably not. People like Frank, they rationalize.
They convince themselves they deserved it. They needed it. They were justified.
They never really accept that they’re thieves until the cell door locks behind them. And even then, they blame circumstances instead of choices. I’m not the same person I was 5 years ago.
That person would have seen a $2,000 bonus and been grateful. Would have thanked his boss and never questioned whether it was correct. The person I am now would have verified it immediately, would have pulled up the approval documentation, would have demanded an explanation for any discrepancy.
Some people might say I’ve become cynical. I prefer to think I’ve become aware. Aware that systems fail, that people lie, that trust without verification is just naive waiting to be exploited.
But I also learned something else. I learned that when you do get robbed, when someone does betray your trust, there are people and systems in place to make it right. It takes time.
It takes patience. It takes mountains of documentation and cooperation with investigators and prosecutors and attorneys, but justice, slow and imperfect as it is, does eventually show up. Frank Nuan stole $145,000 from me, but he lost eight years of his life, his marriage, his career, and his freedom.
I got my money back, plus interest. He’ll be paying for his crime for the rest of his life. The person who really lost was Dorothy.
She did nothing wrong except trust her husband and share her passwords, and she lost her marriage, her career, her peace of mind. I ran into her about a year ago at a Starbucks in Midtown. She was visiting Atlanta for her son’s college graduation.
We talked for 20 minutes, awkward, but genuine. She asked if I’d fully recovered financially. I said yes.
She told me Frank had written her from prison asking for forgiveness. She’d never responded. Some betrayals, she said, are too fundamental to forgive.
I understood that. If you made it this far, hit like. You’ve earned it.
