Several transfers.

Device logins.

Shared household credentials.

Some transactions clearly benefited Sabrina’s salon.

But benefit alone did not prove she personally executed them.

Then one piece changed things.

An authorization email had been sent from a tablet registered to Sabrina’s salon account.

Another used a saved signature image originating from a document folder tied to her business laptop.