“Cover my son’s college expenses,” my brother said, handing me a $16,000 bill for the dorm, laptop, and meal plan. I calmly told him that wasn’t going to happen.

The family messages.

Then Mark texted:

**Bring a cashier’s check on Christmas. Make it payable exactly as shown. Don’t make this awkward for Ethan.**

I saved the message.

When I reviewed the invoice’s digital properties, the author was listed as M. Hayes.

It had been created on a computer registered to Heritage Home Interiors, the furniture store where Mark claimed he still worked.

I called the store.

The receptionist became quiet when I mentioned his name.

“Mark hasn’t worked here since October.”

The next day, one of his former coworkers contacted me.

Her name was Celia Brooks.

She explained that money had gone missing from several customer accounts during Mark’s final months at the store.

Rather than face a larger dispute, he had agreed to repay $9,460 by December 27.

That amount was almost exactly the difference between Ethan’s real bill and the fake one.

Mark’s plan became clear.