The ghost appeared on Thursday. Amara had spent the morning rebuilding the Greco payment trail from raw transaction logs because she no longer trusted the reports generated through the company’s accounting interface. Around eleven, she noticed that several records had been accessed recently by a user ID that should not have existed. The credential belonged to a former employee who had left Adeyemi Group four years earlier. The account was still active. That was bad.
What it had been opening was worse. Greco Maritime. Historical ownership files. Settlement-related transfers. The same Malta routing references Amara had found in the Apapa folder.
Not random.
Someone else was following the same thread. She requested the former employee’s personnel file. The name had been partially suppressed after a data-privacy request, but the hiring approval remained visible.
Ade Senior.
The departure date was 2020. The user activity was from last week. Amara called IT security into the conference room and asked one question at a time. Nobody knew why the credential remained active. Nobody could explain why multifactor authentication had been disabled. Nobody wanted to be the person who said aloud that someone inside the company had preserved a back door for years.
Kolade joined halfway through.
“Can you identify the current device?” he asked.
“Not yet,” the security lead said. “The sessions are proxied.”
“From where?”
“Mostly Europe. Sometimes Lagos.”
Amara looked at Kolade. Dante Greco had business interests in Milan. Neither said the name. After IT left, Kolade closed the door.
“You think it’s Dante.”
“I think Dante is one of the people with motive and technical means to want this information.”
“That is a very auditor way of saying yes.”
“It is a very auditor way of saying I do not know.”
Kolade walked to the window.
“If he has someone inside my company—”
“Had. The credential belonged to a former employee.”
“That does not improve it.”
“No.”
He turned back. “What exactly is he looking for?”
Amara opened the access history on the screen. “The same thing I am.”
“The murder?”
“Maybe not just the murder.”
She highlighted the settlement files.
“These records are recent. Someone has been monitoring money that began moving long after Matteo died.”
Kolade stared at the dates.
“Settlement?”
“That is one of the labels. I haven’t seen the underlying agreements.”
“My father?”
“His office accessed some of them.”
Kolade exhaled slowly. Another fact he had not been told. Amara almost felt sorry for him. Almost.
“What do we do?” he asked.
“We disable the credential, preserve the logs and follow the access pattern without warning whoever used it.”
“You think they’ll try another route.”
“If they need the information badly enough.”
“And if it is Dante?”
Amara looked again at his profile on her second screen: private, controlled, nearly invisible.
“Then he has been inside your family’s secrets longer than I have.”
She paused.
“And unlike me, he did not need permission to start looking.”