Daniel’s face tightened.
“Did you use Dad’s old password?”
Sophie lowered her eyes.
“Once. He had it saved in the browser.”
Lily spoke quickly. “We didn’t know about the account.”
Sophie nodded. “Not at first. But I saw a file on the desktop with your name.”
She looked at me.
“I clicked it.”
My heart sank.
“What did you see?”
“Scanned documents. Bank forms. I didn’t understand most of them. I knew there was money because Grandma had talked about your education fund.”
“Did you take it?”
“No.”
Her answer came immediately.
“I swear. I thought I was looking at old paperwork. Then a website opened and asked me to update recovery information. I closed it.”
Lily began to cry quietly.
“I used the computer later,” she said. “I was trying to help Sophie with an application. A message popped up saying the account needed verification. I entered the email we had made because I thought it was connected to Dad’s account.”
Daniel covered his face with one hand.
“Did you enter a phone number?” he asked.
Lily nodded.
“Sophie’s old number.”
“And after that?” Mr. Ellis asked gently.
“Nothing,” Sophie said. “We forgot about it.”
The investigator later determined that the girls had not transferred the money themselves. Their careless access had created the opening, but someone else had used the information afterward. The similar email address and phone number made the false account appear connected to Daniel.
The final link came from a record recovered from the old laptop.
An automated message had been saved in the drafts folder. It was from Elaine Porter, sent to an address Grandma had used only for banking.
The message did not contain account numbers or passwords. It simply said:
I’m sorry. I should never have told anyone about the accounts. I believed they were helping you, but I was wrong. Please do not contact me until I can explain.
Elaine had not been the person who took the money. She had mentioned the accounts to a former associate who claimed he could help Grandma consolidate them. That associate had created the false financial accounts and disappeared after moving part of the funds.
He was eventually located through the institution’s fraud investigation. Most of the remaining money was recovered. The bank reimbursed the balance of the birthday account after confirming that the withdrawals were unauthorized. The education account was restored almost in full, though the process took months.
