Email archives.

Access records.

Invoice documentation.

Bank transfers.

Chloe’s device.

No assumptions.

Some transactions initially attributed to her had legitimate explanations.

That mattered.