Chapter 2 - SOFIA’S COPY
The USB was imaged the next morning.
Not on a Bellandi laptop.
Not in Nico’s office.
Priya used an outside forensic firm with read-only tools, hash verification, and a witness log.
Rafe hated the delay.
He also understood.
Sofia had told him to verify.
The drive contained twelve folders.
No dramatic folder labeled MARCELLA CRIMES.
Sofia was not careless.
The top file was:
READ FIRST — CONTEXT.
Priya opened.
Sofia had recorded a video.
She looked thinner than Rafe remembered.
Head scarf.
No makeup.
Hospital room.
She spoke slowly.
“If this copy is being watched, I probably failed to resolve this quietly.”
Rafe looked away.
Vivia was not present.
No child should watch her mother’s dying evidence statement unless later appropriate.
Sofia continued:
“I found irregular payments in Bellandi Foundation and Bellandi Hospitality related-party vendors. Some may be legitimate. Some are not adequately supported. I am not alleging theft against everyone named.”
Priya nodded.
Good.
Then:
“The core issue is that approvals are being backfilled. Documents dated before meetings were created after. Several signatures attributed to me were placed on approvals I did not sign.”
Rafe stiffened.
Then:
“I confronted Marcella twice. She said the family office sometimes regularizes paperwork after urgent payments.”
Regularizes.
Sofia:
“That may explain some. It does not explain altered audit trails.”
Then:
“I told Celeste. She told me not to turn sloppiness into scandal while I was ill.”
Rafe looked toward Nico.
Their mother knew concerns.
Nico’s face changed.
Then:
“I told Nico only that I needed independent storage. I did not tell him details because he represented the group.”
Nico stared at screen.
Sofia had protected him from conflict.
Then:
“Rafe knows I was worried. He does not know full scope because I kept waiting until I could prove more. That delay is mine.”
There.
No saint.
Then folders.
1. FOUNDATION VENDORS.
2. HOSPITALITY CONSULTING.
3. SIGNATURE COMPARISONS.
4. BOARD MINUTES METADATA.
5. MARCELLA EMAIL EXPORT.
6. CELESTE EMAIL EXPORT.
7. ADRIAN CROSS — DISCLOSED?
8. FAMILY OFFICE ACCESS LOGS.
9. NOTES.
10. ORIGINAL SOURCES.
11. UNVERIFIED.
12. IF I DIE.
The name Adrian Cross stopped everyone.
Marcella’s new husband.
Priya:
“Do not assume he participated.”
Folder title even said DISCLOSED?
They opened later.
First, money.
Bellandi Foundation had paid three consulting companies over thirty months:
North Vale Strategy.
Lumen Events.
Crescent Impact Partners.
Total:
$2.74 million.
Was that missing?
No.
Invoices existed.
Work existed.
But market-rate review suggested some overbilling.
Some deliverables duplicated.
Some contracts approved without independent bidding.
Ownership:
North Vale — cousin of Celeste.
Lumen Events — Marcella’s former college roommate.
Crescent Impact — layered LLC whose beneficial owner was initially unclear.
Then Sofia’s note:
Do not call this theft without tracing value delivered.
Again.
Good.
Then altered approvals.
Several board minutes showed Sofia approving vendors on dates she was hospitalized elsewhere.
Metadata showed PDFs created weeks later.
Digital signatures pasted.
Not cryptographic.
Images.
Sofia’s signature.
Then one email from Marcella to family-office controller, Bruno Hale:
Need Sofia approval line completed so audit packet closes.
Bruno:
She is out this week.
Marcella:
Use prior signature image. She already supported program concept.
There.
Was that criminal forgery?
Potentially.
But maybe internal approval reconstruction.
Still false.
Then Bruno:
Nico will hate this.
Marcella:
Nico does not need every housekeeping detail.
Nico swore softly.
Then Celeste email:
Marcella, stop putting Sofia’s name on files while she’s on medical leave.
Marcella:
Then sign yourself.
Celeste:
I will not sign retroactively either.
So Celeste objected at least once.
But then another:
Celeste:
We cannot reopen every grant because Sofia wants perfect paper.
There.
She minimized.
Then Crescent Impact.
Beneficial ownership search in Sofia’s notes pointed to:
Cross Advisory Holdings.
Adrian Cross?
Same surname.
But the ownership record dated before Marcella and Adrian publicly announced relationship.
Priya:
“Need verify.”
Outside search later confirmed:
Crescent Impact was majority owned by Adrian’s older brother, Thomas Cross, with Adrian holding a 10% passive interest through family trust.
Disclosure required in foundation related-party policy if Marcella relationship existed.
When did romance begin?
Publicly one year ago.
Payments started twenty-eight months ago.
Sofia had note:
M says Adrian was only “professional contact” when first contract signed.
Could be true.
Then email export.
Marcella to Adrian, two years earlier:
Dinner Thursday after the foundation meeting?
No work talk this time.
Adrian:
Deal.
Romantic relationship likely already forming.
Then contract renewal signed by Marcella three months later.
No conflict disclosure.
Potential ethics/fiduciary issue.
Did Adrian know?
His emails:
You should probably tell board about us before next renewal.
Marcella:
Not yet. Mother will turn it into marriage politics.
Adrian:
Then I want no role in review.
That supported he knew relationship secrecy but may not know falsified approvals.
Then one later:
Marcella:
Sofia is digging into Crescent.
Adrian:
Let her. Tom’s deliverables are real.
Marcella:
That isn’t the point.
What point?
No answer.
Then Priya said:
“This may be conflict concealment, not embezzlement.”
Rafe:
“Why did Marcella panic?”
More folders.
IF I DIE contained a short note:
The biggest risk is not Crescent itself.
It is the Reserve.
Reserve.
Bellandi Foundation Legacy Reserve.
A donor-restricted pool established by Rafe’s grandfather for scholarship and emergency family-community grants.
Balance:
$18 million.
Sofia found transfers labeled:
temporary program advance.
Money moved from Reserve to general operating account, then restored weeks/months later.
Not stolen permanently.
Why move?
Cash-flow smoothing.
Could be unauthorized use of restricted funds.
Marcella approved.
Celeste knew at least some.
Then one transfer:
$1.2 million not fully restored.
Where?
Paid to Bellandi Hospitality as “facility reimbursement.”
Facility:
Villa Serafina.
The wedding venue.
Owned by Bellandi Hospitality.
Foundation reimbursed for renovation of event wing, claiming charitable community-use space.
But tonight’s wedding used it.
Sofia’s note:
If charitable money improved private family venue, disclose and repay fair share.
There.
This was not hidden offshore crime.
It was family using charitable assets and paperwork flexibly.
Then why hide USB in dress?
Sofia explained in final video.
“I reported concerns to internal audit.”
Who controlled archive?
Family office.
“Two weeks later, one backup folder disappeared.”
Could be retention.
Could be accidental.
Then:
“I found my medical-leave access revoked, which was normal. But someone used my credentials after revocation to approve a vendor.”
Identity misuse.
She became afraid records could be altered.
Then:
“I made two copies. One with Priya’s predecessor? No, she didn't know. One offsite bank box, one hidden where Marcella would not look.”
Dress.
Why that dress?
Sofia smiled weakly on video.
“Marcella hates it.”
Rafe almost laughed.
Then:
“She once told me it made me look like I was trying to become a Bellandi before I married Rafe. I kept it because it was mine before any of them decided what I belonged to.”
There.
The dress symbolized independence.
And Marcella had tried multiple times after Sofia’s death to have it donated.
Rafe remembered.
“She said moth damage.”
Nico:
“She asked me too.”
Then one inventory email from Marcella to house manager after Sofia’s funeral:
Please remove the old blue gala dress before Vivia sees it. Sentimental hoarding will make this worse.
House manager replied:
Rafe asked that all Sofia personal items stay.
Marcella:
I’ll handle him later.
There.
She suspected.
Did she know USB specifically?
Maybe not.
Then another email after Vivia asked to wear dress at a family anniversary:
Marcella to Celeste:
Absolutely not that blue dress.
Celeste:
Why do you care?
Marcella:
Because Sofia used to hide things in linings and pockets like a lunatic.
That line.
Celeste:
What things?
No answer.
So Marcella knew Sofia sometimes hid documents physically.
Maybe she guessed.
Then Priya:
“She may have been afraid there was a copy. That does not prove she knew contents.”
Rafe looked at wedding footage in his mind.
Marcella lunging.
Destroy it.
Enough to investigate.
Then the handwritten note contained one more line they had missed in ballroom, written on back:
Rafe, if Marcella is still marrying Adrian when you find this, do not assume the wedding is the fraud. The wedding may only be the day everyone is finally in the same room.
That explained timing in story logic.
Sofia did not plan the wedding reveal.
Vivia wearing dress did.
But Sofia anticipated one thing:
Truth would need witnesses.
The independent auditors also checked something Sofia had flagged but not resolved: whether the Reserve transfers had ever endangered scholarship payments.
They had not.
That mattered.
The Foundation had maintained enough unrestricted cash to pay every committed scholarship and emergency grant.
So the misuse was not:
students lost tuition because Marcella took money.
It was:
restricted donor funds were used outside their permitted purpose because family leaders believed they could restore them later.
A governance breach can be serious without requiring a child to lose school.
Then Priya asked Rafe:
“Did Sofia ever tell you she was making a copy?”
“No.”
“Would you have supported?”
“Yes.”
“You know that now.”
He stopped.
Good.
Maybe at the time he would have said:
Let Nico handle.
Let Mother fix.
You’re sick, rest.
Sofia may have expected exactly that.
Then Rafe found one text he had sent Sofia during treatment:
Please stop thinking about the Foundation for one night. Marcella can handle it.
He stared.
It was loving.
It was also painful in hindsight.
Sofia had replied:
That is what I am afraid of.
Rafe had sent a heart emoji.
He had not understood.
That message became part of his own accountability, not evidence of wrongdoing.
Then Vivia asked why everyone kept saying “Foundation.”
Rafe gave an eight-year-old version:
“Your mom found out adults were using some charity money in ways the rules did not allow. She saved copies so other adults could check.”
“Was Aunt Marcella stealing?”
“Some money was used wrongly. Adults are still checking exactly what happened.”
Good.
No premature verdict.
Then:
“Did Mommy know she would die?”
Rafe’s throat tightened.
“She knew she was very sick.”
“Is that why she hid it?”
“Probably partly.”
Vivia looked at the repaired-looking split seam still in evidence photographs.
“Why not tell you?”
Rafe answered:
“She was afraid records would disappear and she waited too long to trust people. That was one of Mom’s mistakes.”
Vivia frowned.
“Mom had mistakes?”
“Yes.”
That mattered too.
Then Priya found one more item in the USB notes:
If Rafe is angry I hid this from him, he should be.
Rafe laughed through tears.
Sofia had anticipated.
Then:
But if he turns that anger into war with Marcella, remind him this is an audit problem before it is a family revenge problem.
Priya read aloud.
Rafe sat back.
Even dead, Sofia was stopping him from becoming the Bellandi version of justice.
No private punishment.
No family retaliation.
Audit.
Law.
May you like
Process.
He listened.
