The Receipt That Was Paid Twice

The receipt was for a small amount: just 480. But Najla knew the paper was lying before she finished her coffee. The problem was not the amount. It was that the same receipt appeared twice in the Harbor Bookshop’s accounts, six months apart—even the ink stain near the edge was in exactly the same place.

Najla arrived at the bookshop on Monday morning with a small laptop and a yellow notebook, the only notebook she used for audits she expected to take a long time. Adel, the owner, was preparing to sell a forty-percent stake to a new partner and wanted the accounts checked before signing the contract.

"I'm not expecting anything exciting," he told her as he opened the office door. "I just want clean numbers before the sale."

Najla said, "Clean numbers usually don't need anyone to check them."

Adel laughed. He didn't laugh two days later when he understood what she meant.

Two copies cannot be a coincidence

The first receipt was dated March: a wooden shelf for the history section, costing 480. The supplier was a local company the bookshop had used for years. The order number was 7714, the delivery date was correct, and a warehouse employee had signed the goods-received box.

Six months later, the same receipt appeared in September.

The same amount. The same order number. The same shelf description. Even a small black line left by the supplier's printer near the edge appeared in the same position.

But the second version contained an addition that was not in the first: Adel's signature in the approval box.

Najla placed the two papers side by side.

Najla asked Adel, ‘Did you buy one shelf or two?’

He said: "One, if I remember correctly."

"And you paid twice?"

Adel moved closer to the screen. ‘Perhaps. Sometimes an invoice arrives twice.’

That was a possible explanation, and that's why she didn't object.

Najla called the supplier from the office phone with Adel present. The employee checked the records and said the company had received only one payment of 480.

Najla opened the bank-transfer statement.

There were actually two transfers.

The first went to the correct supplier's account. The second went to an account with an almost identical name, but with one letter different in the trade name.

Adel said: "Input error?"

She said, ‘If it’s a mistake, we may find only one. If it’s a scheme, we’ll find others like it.’

Twenty-Three Transactions Like the First

Najla wasn't looking for large sums of money. She was looking for repetition.

Three hours later, she had seven suspicious invoices. By the end of the day, the number had reached 14. On Tuesday morning, it had climbed to 23 transactions in 11 months.

No payment exceeded 900. Most were between 200 and 650. All were linked to actual invoices that the bookshop had already paid, then their number or image was reused to transfer a second amount to an account with a name close to that of the original supplier.

If someone stole 15,000 all at once, the shortage would be immediately apparent. But 300 here and 520 there disappear into expenses for paper, maintenance, transportation, and furniture.

Najla calculated the total.

It was too big to be called a mistake, and too small for anyone to have noticed it at a quick glance.

Adel said, "Who can do this?"

Najla asked for the list of system permissions.

There were 3 people who could authorize the payment: Adel, the branch manager Hossam, and the cashier Marwan.

The easiest suspect

Marwan looked like a conveniently obvious suspect—too conveniently.

Most of the transfers originated from his device or from sessions bearing his user ID. In his desk drawer, Adel found an old approval stamp that he was supposed to discard after the procedures were updated.

Most importantly, Marwan was experiencing financial difficulties. The employees knew that his mother had undergone expensive treatment months earlier, and that he had requested an advance on his salary.

Adel said in a low voice, "I hope it's not him."

Najla asked him: "Because you trust him, or because you have a reason to exonerate him?"

He did not answer.

Adel asked her to report the matter to the police at once. Then, in the same breath, he changed his mind: he did not want to ruin an employee’s reputation before knowing the facts.

Najla said: “We will not investigate a crime ourselves. I will only document what my review powers allow, and we will not search a personal device or open a private account. Give me until tomorrow. If the indicators remain the same, the internal review will stop and we will transfer the file to the competent authority.”

Adel agreed.

Najla asked Marwan to explain the closing of a typical day's work. He sat on the edge of the chair, placing his notebook in front of him as if handing over something he had no right to keep. He started with the figures, then paused to ask if she wanted to talk about the advance payment. She said she wanted to organize the work first. He returned to the page, but his voice became faster, and he began explaining even things she hadn't asked him about.

Halfway through the conversation, Marwan’s phone rang. He looked at the caller’s name and silenced it. A moment later, it rang again. Najla said he could answer, and he stepped into the corridor. She heard only, ‘Yes, I bought the medicine. I’ll come by after closing.’ Back at the desk, he placed the phone face down. His face was flushed, not because of a question about a transfer, but because his mother’s difficulties had become part of the way people looked at him at work.

She asked about the old stamp. Marwan said he had found it in a stationery box and put it in his drawer until he could ask Hossam about it. Najla asked him to write down what he remembered, including the approximate date. She did not say whether his account cleared or implicated him. He kept searching her face for a verdict. Handing back his notebook, she said, ‘If you don’t know a detail, write that you don’t know. Don’t fill in the gaps for our benefit.’

As she stepped outside, she saw Adel watching from behind the glass door. He glanced at Marwan as if asking if it was all over. She shook her head. She knew that a frightened person could appear guilty at every turn, and that if they used his fear as evidence, they would find what they were looking for, even if the money had gone to someone else.

8:07 p.m.

Najla arranged the operations according to time.

The first clear pattern appeared.

Almost every duplicate payment had been sent at 8:07 p.m.

The bookshop closed at eight, and Marwan normally finished the till at that time or a few minutes later. It looked as though someone waited for the last customer to leave before acting.

Najla requested the system login logs and available camera footage. Old recordings were automatically deleted after a while, so no video remained of most operations.

But the bookshop had installed a smart lighting system after its electricity bill increased. The system keeps a record of room usage, not to track staff, but to monitor consumption.

On almost every suspicious evening, Adel’s office lights were on between 7:50 and 8:15 p.m.

Marwan's office, however, did not always have light.

Adel said, "So someone is using my office."

Najla asked him where he was on those dates.

He checked his calendar, photos, and travel letters. Four nights he was out of town. On the fifth night he was at a family party two hours away.

His signature remained in the system.

His office remained lit.

His password remained in use.

Hossam knows the building better than anyone.

Hossam had been the branch manager for 5 years. He knew the keys to the doors, the employees' schedules, and the location of almost every piece of equipment. He would sometimes come in on holidays to check the inventory.

That wasn't a crime. In fact, it was one of the reasons Adel trusted him.

When Najla asked Hossam about the transfers, he said, ‘If they came from Marwan’s computer, start with him.’

She said, "I don't start with people. I start with the pattern."

He smiled briefly. "That's what accountants say."

She said, "That's why Adel summoned me."

She didn't like the way he tried to push her towards Marwan before she could ask him anything else, but she wrote a note and didn't turn the impression into evidence.

Cut edge

In the evening, she rearranged the invoices in a way that seemed strange to Adel: not by date, supplier, or value, but by paper.

The bookshop used two printers. A modern printer in the front office, and an older one in the back room. The older printer pulled the paper at a slight angle and cut a small portion of the watermark printed on the internal forms.

The cut-out mark appeared in almost all copies of the suspicious invoices.

Adel asked, "Who uses that printer?"

Adel answered his own question. ‘Anyone can use it, but Hossam uses it most. He insists it saves ink.’

Najla was not satisfied.

The presence of invoices on a printer used by Hossam does not prove that he printed them. Any employee can enter the room.

Adel asked, "How much evidence do you need?"

She said, "Evidence to prove what we're saying, not a collection of things that make us like the story."

The invoice that did not exist

On Wednesday morning, Najla conducted a test within the internal accounting environment. She did not create a real transfer, nor did she send money. She created a review invoice in the name of a fictitious supplier and marked it to prevent actual execution.

Najla added a note visible only on the payment-approval screen: ‘Supplier discount expires tonight.’

She didn't tell anyone about the test.

That evening, Najla kept Adel with her in the office. Marwan closed the till in front of them. Hossam was in the storeroom counting boxes of books with another employee.

At 8:07 p.m., a second payment instruction appeared against the fictitious invoice.

No money left the account: Najla had disabled execution of the test payment.

Adel said, "So it's not Hossam. He's in the warehouse."

Marwan, who was beginning to understand that he was the one under suspicion, said: "Not me."

Najla looked at the time the order was created, not the time it was executed.

It had been created at 12:43 p.m., then scheduled for 8:07 that evening.

She said: "A person doesn't need to be in front of the device at eight o'clock. They need to be in front of it at noon."

Wireless keyboard

The system log revealed that the order was created from Adel's account and on his office computer.

Adel said: "I was with you at 12:43."

Najla remembered that. They were in the meeting room reviewing the sales contract.

They went to his office.

The computer was locked, but Najla did not touch it. She only looked at the connected devices shown in the asset register that she had requested on the first day.

Eight months earlier, Adel’s keyboard had been replaced with a wireless one.

Najla asked, ‘Who installed it?’

Adel said, ‘Hossam. The old keyboard kept failing.’

The small receiver was listed as an accessory, but an older note recorded that a spare keyboard had been tested in the next office during installation.

Najla asked Adel not to touch anything.

This point went beyond financial review. There was now a possibility of unauthorized access to another user's device and account.

She said, "We stop here."

From review to investigation

Adel contacted the company's lawyer. He arrived in the morning and requested an independent technical specialist to secure the records and devices according to clear procedures. Najla did not search Hossam's computer, nor did she ask for his phone password, nor did she attempt to recover deleted files.

That was important to her. Solving the mystery wasn't as important as ensuring the evidence remained valid and that suspicion didn't become a license to violate everyone's privacy.

The specialist saved system logs and found that several orders were created from Adel's session via a wireless input device that could be operated from an adjacent room. Modifications to supplier data were also discovered, made from an administrative account at times when Hossam was present in the building.

Only then did Adel confront Hossam in the presence of the lawyer.

Hossam did not begin by denying it.

He said, "I didn't take the money for myself."

Theft disguised as assistance

Hossam explained that he created accounts with names similar to those of the suppliers, and then transferred the second payments to them. He would collect the money in an intermediary account and use it to help employees facing crises.

Marwan did receive an undisclosed sum of money that helped with part of his mother's treatment. He thought it was a donation from someone who wished to remain anonymous.

A saleswoman in the children's department received a month's rent allowance when she was at risk of losing her home. A warehouse worker received assistance after a car accident.

Hossam said: “I didn’t buy a car. I didn’t travel. You can check everything. The money went to them.”

Adel said, ‘But it wasn’t your money.’

Hossam replied: “It would have stayed in the profits. 300 or 500 means nothing to the bookshop, but it means medicine to someone.”

Najla said, "And you made the people you helped the first to look guilty when the matter came to light."

Hossam looked towards the door.

Najla added, ‘Marwan’s computer. His need for money. The stamp in his drawer. All of it made him the perfect cover, whether you intended that or not.’

He did not answer.

The seal is in Marwan's drawer

One question still troubled Marwan: how had the old approval stamp reached the stationery box where he found it, and who had put it there?

He said he had never seen the stamp before finding it in the box and moving it to his desk drawer.

Najla could not prove who placed it, so she refused to write an unsupported conclusion. She only recorded where it was found and who had access to the area.

Marwan said angrily, "So people will still think I was part of this?"

She said: "The report will say what we know and what we don't know. Our inability to prove who put the seal on doesn't allow us to invent an answer."

He was not satisfied with that, but he later understood that the rule itself had prevented him from becoming an accused because of a set of convenient signals.

The money that saved a person and hurt him

Weeks later, Marwan contacted Najla.

He said the hardest thing was not being suspected, but discovering the source of the help he received.

‘I was grateful to someone whose name I didn’t know. Now, whenever I remember my mother’s treatment, I feel that I benefited from a theft.’

Najla said to him, "You asked for an advance on your salary. You didn't ask anyone to take money from the bookshop's account."

"But I benefited."

“Benefiting from an action you were unaware of does not make you complicit in it. Responsibility follows what you did and knew, not what someone else decided in your name.”

Marwan fell silent.

Then he said, "I wish Hossam had asked me to look for a legal way."

She said, "And that's the part that doesn't show up in the numbers."

What did Adel do next?

Adel did not stop at changing the passwords.

Adel separated the creation of supplier records from payment approval, so nobody could add a new account and then authorise a transfer to it alone. He introduced an alert for duplicate invoice numbers and an automatic check when an account name closely resembled an existing supplier’s but used different bank details.

He abolished shared accounts, reviewed employee permissions and set a longer retention period for important records.

But Najla said technical controls alone would leave half the problem unresolved.

She said, ‘Hossam found a real need here. His method was wrong, but his confession has not made that need disappear.’

Therefore, the bookshop established a public aid fund. An employee could submit a confidential request to a two-person committee, not to a single manager. Its funding sources, spending rules, and auditing procedures were defined, and it became possible to make voluntary donations to it.

The needy are no longer obliged to reveal the details of their lives to their colleagues, and no single person can decide that their good intentions give them the right to dispose of other people's money.

Why did the trick work all this time?

After the case ended, Adel and Najla reviewed all twenty-three transactions. They found that the scheme had relied less on technical brilliance than on a collection of weak working habits.

Smaller invoices received less scrutiny. Similar supplier names went unnoticed. Adel's electronic signature was treated as proof of his personal presence. And the staff trusted Hossam because he was helpful and knew the system.

Adel said, "I thought that trust would reduce our need for procedures."

Najla said: “Good procedures do not say that we do not trust people. They say that we do not want to put a trusted person in a position where he has to resist temptation, pressure, or justification on his own.”

The evidence was not a single piece of evidence.

With authorisation, Najla kept a copy of the first receipt for internal training, after removing sensitive information.

When Najla later explained the case, she refused to call the edge of the paper the decisive clue. There had been no single magical piece of evidence.

The lookalike account revealed an unusual destination. Repeated invoices established a pattern. The 8:07 p.m. timing exposed the scheduling. The lighting records showed that Adel’s office had been used. The paper linked the copies to the rear printer. System logs and technical documentation turned a plausible suspicion into a case that could be formally examined.

But the most important thing Najla learned was not technical.

Human error changes. Someone might write down a number wrong once, forget a digit once, or make a duplicate payment on a busy day. But a plan creates habits because it needs a repeatable method.

Habits leave a pattern.

After 6 months

Six months later, the stake was sold to the new partner, after the transaction had been delayed until the legal review was complete. The bookshop stayed open, and employees who had received help without knowing its source were not dismissed.

As for Hossam’s case, it was left to the competent authorities and lawyers, and Adel did not try to turn the bookshop into an internal court.

In the first meeting after the new partner joined, Adel presented a report on the new payment system.

The employees expected a long speech about integrity and betrayal.

He didn't.

He simply said: “We will not build a system that assumes everyone is a thief, and we will not build a system that requires everyone to be an angel.”

He then explained the dual approval mechanism and the assistance fund.

At the end of the day, Najla passed the history section. The wooden shelf that had started it all was still there, carrying heavy books, unaware that it had appeared twice in the accounts.

She took the receipt out of her bag and wrote underneath it:

"A big scam doesn't always start with a big number. Sometimes it starts with a copy that looks so familiar that nobody looks at it twice."

Then she added a second line:

"Trust is not protected by stopping questioning; it is protected by building a system that allows us to question without wronging anyone."