10.

Swindon. Roundabouts and distribution centers. Big white industrial sheds surrounded by dwarf willows and artificial lakes. Wire fencing.

I park in a 250-bay car park. Sign myself in, in a high, glass-fronted lobby. Get a plastic badge and am told to go to the third floor. Three people waiting for the lift: two men and a woman, all in dark grey suits. The woman is saying something about warehousing issues in Poland, but falls silent when the lift comes. We travel up in silence.

On the third floor, there’s another reception desk. I’m feeling a bit spacey – I often do in these places – so I have to blink a few times before finding the name I need.

‘Kevin. Kevin Tildesley,’ I say, when I’m done.

The woman behind the desk says something. I sit down. There are magazines on a low table – Furniture World, Furniture Today – but I resist their lure.

Every ten seconds or so something electronic bleeps. I look at my hands and try to remember who I am.

Then Tildesley arrives and I feel immediately less weird. He takes me through to a small conference room with a view out over the dwarf willows and the phony lake. Tildesley feels more cheerful this time, less stressed. I guess he’s feeling more secure about his job. That the mess won’t end up being blamed on him.

I explain why I’m here. Tell the truth. About T.M. Baron, and the money that went to Spain, and the money that was withdrawn in cash. Tell him about Hayley Morgan and how she died.

‘Christ,’ he says. ‘Jesus.’

No one really knows what it’s like to die from a combination of rat poison and starvation, but it isn’t good. The poison in question was a second generation anti-coagulant. The stuff works by thinning the blood so much that the body’s capillaries become dangerously permeable. Blood starts to leak into joints and muscles, so that victims literally bleed to death, though the bleeding is all internal. Scientific studies of hemophiliac pain suggest that the effect is moderately to severely painful. And not particularly fast.

‘We’ve done what we can to chase up the ultimate recipients of the cash, but the money has long gone offshore. Outside the EU, even. So we need to work on the front end. When the scam was set up. How it was set up. How it was kept going.’

‘OK. Yes. OK. As you can imagine, there’s been an inquiry here.’ Tildesley raises his eyebrows in an imagine-the-drama kind of way. ‘Some of our historical procedures were, quite frankly, lax, and of course on the audit side …’

We get into the nuts and bolts. Tildesley isn’t that great at explaining things, but he does understand his subject.

Historically – that is, in the Days Before Kevin – payroll was administered both locally and nationally. So the system was constructed and audited at national level, but it made use of inputs generated locally. ‘So if, let’s say, the manager of the Bridgend store needed to hire some extra staff for Christmas, he’d have made a request in the regular way. We’d approve that sort of thing instantaneously, normally. Then he’d have entered the names and payment details at store level, and the data would have flowed through to our national payment system.’

‘OK. I get that. But assuming that the boss of the Cardiff store wasn’t fiddling the system himself – and we don’t think that he was – how come he didn’t instantly notice the fraud? It’s a big store, but there aren’t that many employees.’

Tildesley is shaking his head. Now that he’s not worried about keeping his job, he likes the excitement. Feels like the Swindon-accountant version of a trawler captain caught in a Newfoundland storm. Water waist-high on the foredeck and foam seething on a lee shore.

‘Yes, but that was the clever thing. We assess performance store-by-store and region-by-region. Now obviously lots of our costs are completely local. What a store uses in terms of power, for example, or their staffing bill. But you’ve got other costs that are regional, and others that are national. So all our buying activity is national, but a lot of our marketing and promotion might be regional. The way we work that out is we allocate a set proportion of regional costs to each store in the area. Same thing with our national costs. That way, we get a fair view of the profitability of each store.’

I nod. ‘OK …’

‘And our two individuals – Morgan and Gibson – were given a regional coding, not a local one, not a national one. So the store manager saw the names, and assumed they had nothing directly to do with him. The national payroll team saw that these two names were inputted via the Cardiff store, and assumed it was some regional activity being led out of Cardiff. Both ends of the operation thought the other one was in control.’

Tildesley thrusts papers over the table at me to show the deliciousness of the scam. I don’t completely understand, but don’t think I need to.

‘But someone, somewhere, once sat down at a computer and created these false profiles, correct?’

‘Correct.’

‘And that computer was physically located in Cardiff, in Swindon or somewhere else?’

‘Cardiff.’

‘You’re sure?’

‘Certain.’ Tildesley starts telling me why. Something to do with the input coding.

‘And presumably any member of the Cardiff store could have got access to those computers? I mean, shop-floor staff probably weren’t meant to play around with the payroll system, but they’d have had physical access to the space.’

‘Yes. But we always talk about three levels of access. Physical, network, finance. Physical access: OK, you have rules and procedures, but you know those things are going to be breached. Shop-floor workers take their lunch break. Chat with a secretary. Look at the internet from an office PC.

‘Level two access – access to the firm’s intranet and systems – that’s password-protected. Passwords change every month and they’re unique to every user. We have a complete log of who signs in when and for how long.’

Sure enough, Tildesley pushes a folder at me: a printout of computer log-ons, sorted by date, running back two years.

‘Level three access – getting to move money around – that’s the biggie.’ Tildesley starts to explain it all. It’s complex in detail, but simple in essence. The Swindon head office regards its individual stores with distaste, the way Marie Antoinette thought of her stablehands. Swindon makes the decisions. The stores get to stack shelves and operate cash tills. Any financial decisions above a thousand pounds require authorization from head office. Not even the Cardiff store manager has standing authority to spend the firm’s cash.

I ask Kevin if the store keeps visitor sign-in books for people who come to the store on business. He tells me that those things are computerized now. He makes a call. A girl with a milky face and a navy dress brings a pile of printouts, still warm from the printer.

I ask Kevin if he has a record of any external consultants who had access to the store over the last two and half years. The answer is no, not exactly, but he can find records of any payments made to consultants in the South Wales region, plus the dates of those payments, plus the invoices. I ask for copies of the lot.

And by the time we’re done, I have been here two hours and have a stack of printouts four inches high. Kevin and the girl with the milky face see me to the lifts, my very own guard of honor.

I say to the girl, ‘I like your dress.’

I don’t particularly. I have no feelings on the subject. But I know women say these things to each other, so I try saying it now and again. The disciplines of Planet Normal.

The girl starts telling me about her dress, while I express interest with just a tint of excitement. The lift comes and I leave.

On the way back to Cardiff, I stop at the Leigh Delamere service station for fuel and lunch. Brie and rocket sandwich. A plastic salad thing, which I buy from some sense of duty. Fruit smoothie. But mostly, I just sit there with my printouts and my laptop. Researching.

Call Kevin. Can he tell me which specific computer the data was entered on?

He can’t, but he’ll speak to the IT people.

I try eating my salad with the plastic fork provided. It bounces off the baby tomatoes, has difficulty with the cucumber, but handles the sweetcorn as easy as la.

I call our forensic computer team in Cardiff, the ones who deal with computer frauds and kiddie-porn. Anything really complex is handled by the Hi Tech Crime Unit at SOCA, but our guys are fine with the basics. I ask a few questions, get a few answers.

Find a way of cornering my tomatoes against the plastic wall of the salad bowl and successfully impale them, every last one of them.

Get a call back from Kevin, who has an IT guy with him, another Kevin. Kevin Two starts speaking a language I don’t really understand, even though nearly all of the words seem to be English. Then he gives me what I want: the serial number of the computer from which the fraud was committed.

Phone Dunwoody. I need his permission to do what I want to do next. He squirms. Doesn’t like the responsibility of decision, but knows Jackson has authorized my researches so he doesn’t have much option. Says OK.

I phone our computer people back and ask them to send someone to the store. Say I’ll be there in an hour.

I’m there in a hour and ten. Our guy is already there: Mark Lampley, jeans and a T-shirt, worn under a jacket. He’s drinking tea, not working. I’m about to be pissed off at him, except he pre-empts me. Taps the desktop, says, ‘Trojan horse. Computer is totally compromised.’

I make my IT face at him and he explains further.

‘A Trojan horse is any kind of application which allows a remote user to control a computer. Basically, once the program’s installed it just sits in the background. If someone wants to control it from outside, they can.’

‘How much knowledge do you need to create something like this?’

‘Well, I doubt if the software’s original. This looks like a basic Slavebot app to me.’

‘But you need to be an IT specialist, yes?’

‘Ideally, yes.’

One of Kevin’s invoices showed that Red Dragon Systems, a computer consultancy based down in the Bay, had done work for the store over an eight week period last spring, a period ending about eleven weeks before the payroll fraud began. The Fraud Squad investigation had focused on the period immediately around the fraudulent payroll request itself, so they hadn’t even noticed Red Dragon’s involvement.

The store sign-in data indicates that the firm had three consultants working on the project: Saj Kureishi, Andrew Peters, Colin Cooper.

I look at Mark. He looks at me. Puts his mug down with a bang.

‘Let’s go and arrest some criminals,’ he says.