I Let My Brother Fix My Phone At A Picnic And He Quietly Added Himself Then Tried Taking My Business Money
My brother told me on Facebook Messenger that the family group needed “moderation cleanup” — the same week PNC flagged two wire transfers I never made out of my studio account.
The pouch had been on the console since the day I’d bought it.
My name is Nadine Holloway.
I am thirty-nine.
I own a one-person design studio in Portland called Nadine Holloway Design LLC.
I have run it for thirteen years.
Eleven retainers active.
I specialize in identity systems and frontend UI for small healthcare-adjacent clients.
A regional non-profit hospital network is using a design system I built.
I have been quoted twice in trade publications on accessibility.
I bought my first YubiKey in 2018 after a client’s account was breached via SMS interception.
I run my business email and my PNC business banking on hardware-key two-factor authentication.
I have helped six freelance friends migrate.
I have not, until today, enabled hardware-key 2FA on my own personal Apple ID.
That gap is the one my brother walked through.
It is a Sunday in early October.
Ten-eighteen in the morning.
I am at my home-office desk on the second floor of a Craftsman in the Concordia neighborhood of Portland.
Rain on the office window.
The PNC security email has just arrived.
The subject line reads: “Important: Unusual wire-transfer activity on your business operating account.”
I opened it.
The body of the email said PNC had flagged two recent outgoing wire-transfer attempts from my studio’s operating account, that both had been held under the bank’s standard fraud protocol, and that PNC had placed a 72-hour hold on outgoing wires.
The body listed both attempts.
Attempt one — six weeks ago, August 18, 2:14pm Pacific — $640.00 to a Wells Fargo checking account belonging to one Keith J. Holloway.
Attempt two — three weeks ago, September 8, 11:42am Pacific — $4,200.00 to a Wise USD multi-currency account in the name of Keith J. Holloway.
Total attempted: $4,840.
Total moved: $0.
Both flagged.
Both abandoned at the callback step.
I read the email twice.
I did not stand up.
I scrolled to the PNC fraud-services callback number.
I copied it to a sticky note.
I did not call yet.
I opened my iPhone.
I tapped Settings → my name at the top → Family & Recovery → Trusted Contacts.
Keith Holloway was listed.
The verification date matched Memorial Day, ten weeks ago.
The avatar was a square photo of him I recognized — the headshot he uses for his work Slack at the school district where he is an IT support technician.
The school district’s logo was visible in the background of the photo.
I had handed him my phone at the Memorial Day picnic in Beaverton.
He had said the phone was slow.
He had offered to “tune it up.”
He had taken it for fifteen minutes.
He had come back with it.
He had said: “All good, sis. Cleaned out the photos cache.”
I had thanked him.
I had not checked Settings → Apple ID → Trusted Contacts after he handed it back.
The settings page is twelve taps away from the home screen.
I had not gone to it in seven months.
I closed the iPhone.
I opened my laptop a second time.
I opened Facebook in a private window.
I navigated to Messenger.
I scrolled to Keith.
On Thursday afternoon at 4:42pm, he had DM’d me:
“Nadine — I’m doing some moderation cleanup on the Sunday Supper group. Trimming non-active members. Mom said it was time. Trust the process. Trust the process. It’s not personal.”
He had repeated “trust the process” twice.
On Friday morning at 9:11am, my cousin Linda had DM’d me a screenshot.
The screenshot was the Sunday Supper group’s admin moderation-log entry.
It read: “Nadine Holloway — removed by Keith Holloway. Reason: cleanup — non-active members. 10/2 4:31pm.”
Linda’s text under the screenshot read: “??”
Then a second message at 9:13am: “I’m sure Keith has a reason — don’t make it a thing.”
I had not responded to Linda.
I had not opened Facebook again until now.
The Sunday Supper group was created in 2018, during our father’s last year of cancer.
Every Sunday at five o’clock our family video-calls with anyone who cannot be at our mother’s house in Beaverton in person.
Birthday photos.
Memorial Day plans.
Holiday invites.
Our mother posts in it daily.
I had been a member from the day it was created.
I sat at the desk.
The rain was still on the window.
I walked from the office down the hall to the entry-hall console.
The console is a small wooden table I bought used at Hawthorne Vintage in 2016.
There is a blue ceramic catch-all bowl on it.
There is a small leather pouch on it.
The pouch has the embossed initial “N” stamped into the front, off-center, the kind of personalization a Portland leather shop on Hawthorne does for thirty dollars.
The pouch had been on the console since the day I’d bought it in 2024.
Seven months.
Unzipped only once, the day I unboxed the two YubiKeys.
Re-zipped and set on the console for the day I might need them.
I picked up the pouch.
I held it in my hand.
It weighed what two small hardware keys and a velvet sleeve weigh — eleven, twelve grams.
I did not unzip it.
I set the pouch back on the console.
I stood at the console for one minute.
The rain.
I walked back to the office.
I sat at the desk.
I opened a fresh browser tab.
I went to appleid.apple.com.
I signed in.
The page asked me for an SMS 2FA code.
I knew, by ten-twenty-three on a Sunday morning, that the SMS code I was about to receive on my iPhone was also being mirrored to Keith’s Mac in his apartment in Beaverton.
I knew this with the part of my brain that has spent seven years thinking about how identity systems leak.
I did not sign in further.
I closed the tab.
I picked up my phone.
I texted Tracey Kline.
Tracey is my oldest friend.
Thirty-nine.
She works in IT security at a Portland mid-size bank.
She is the friend who originally told me to buy a YubiKey in 2018.
I texted: “Tracey. Sunday emergency. Five minutes.”
She replied in twenty seconds: “Calling now.”
My phone rang at ten-fifty-four.
Tracey listened to me lay it out in three minutes.
I went chronological.
Memorial Day picnic, phone tune-up, my own thank-you.
PNC’s two flagged wires — dates, amounts, destinations.
Keith on the Trusted Contacts list.
Linda’s screenshot of the Facebook removal.
The leather pouch on the console, the two YubiKeys inside.
Tracey did not ask any clarifying questions.
She has known me since freshman year at the University of Oregon.
She has known Keith since he came to visit me sophomore year.
She does not need a context paragraph.
When I stopped speaking she said one sentence and gave me my next move.
“Nadine. Open the Apple Support call. Say: ‘I need account-security escalation — unauthorized Trusted Contact, request immediate removal under threat protocol.’ Don’t argue with tier one. Make them transfer you. I’m on Signal if you need me.”
I said: “On it.”
We hung up.
At 11:02 in the morning I opened the Apple Support app on my MacBook.
I clicked Apple ID → Get Support → Talk to Apple Support Now.
The call connected to a Tier 1 advisor whose name was Robbie.
He was in the Austin contact center.
I said: “I need account-security escalation — unauthorized Trusted Contact, request immediate removal under threat protocol. I am a small-business owner. I have evidence of two attempted wire transfers from my business bank account that my Trusted Contact made using SMS codes mirrored from my iCloud Messages. The Trusted Contact added himself ten weeks ago without my authorization. Please escalate to senior advisor.”
Robbie said: “Thank you, Ms. Holloway. One moment.”
He put me on hold for forty seconds.
A senior advisor came on at 11:04.
Her name was Daniela.
Senior Account Security Advisor, Austin.
I repeated my framing.
I added the date of the Memorial Day picnic.
I added the verification timestamp on the Trusted Contact entry.
I added the two PNC wire-attempt dates.
I read the school-district Slack avatar detail.
Daniela said: “I’m beginning the Trusted Contact removal now. I will also revoke all active sessions on your Apple ID, rotate your password, and disable iCloud Messages sync from your account. I’ll need you to confirm each step on your authenticated device as I do it. After we finish, I strongly recommend you enable hardware-key two-factor on this account.”
I said: “I have two YubiKeys. I will enroll them as soon as we finish.”
Daniela said: “Then this call will take about twenty-five minutes.”
I sat at the desk.
The rain had stopped.
A neighbor across the street started a leaf blower for two minutes and stopped.
While I was on hold during one of Daniela’s internal transfers, I opened a second browser window.
I logged into my password manager.
I scrolled through the password vault.
I counted the entries that had ever shared SMS 2FA as their second factor: forty-one.
Of those forty-one, eighteen were business critical — banking, Stripe, my domain registrar, two cloud-hosting providers, the file-sharing service my clients use.
The other twenty-three were lower stakes — a meal-kit subscription, a few news sites, two airlines, a pharmacy login.
I made a list on a Post-it.
I put the Post-it on the desk to the left of the keyboard.
The Post-it said: “Migrate 18 today. Migrate 23 by Tuesday.”
I thought, briefly, about the night I bought the first YubiKey in 2018.
A client of mine, a thirty-bed psychiatric clinic in Salem, had been hit by a SIM-swap attack on the clinic director’s number.
The breach had cost the clinic two weeks of operational chaos and $14,000 in incident-response fees.
I had driven home from Salem at midnight after the post-mortem and bought two YubiKeys from Amazon at one in the morning.
Tracey had laughed at me on the phone the next day for buying them at one in the morning.
She had also said: “Good. Now use them on everything that touches money.”
I had used them on the business email and on PNC.
I had not used them on Apple.
That was the gap.
At 11:18am Daniela confirmed the Trusted Contact removal had been initiated.
At 11:31am she confirmed the removal had completed and was reflected on Apple’s account-security backend.
At 11:33am she walked me through the password rotation.
I generated a new password in 1Password.
At 11:34am all active sessions on my Apple ID were revoked.
Any device signed in to my Apple ID — including, I would later confirm in the change log, a device labeled “Keith’s MacBook Pro” — was force-logged-out.
At 11:36am iCloud Messages sync was disabled at the account level.
Daniela said: “Ms. Holloway, the unauthorized Trusted Contact has been removed and the account is fully reset. I’ll send a confirmation email to your address of record.”
She read my address back to me.
I confirmed.
The confirmation email arrived in my inbox at 11:39am with case number AS-2026-OCT-77041.
I printed it.
I unzipped the leather pouch.
The two YubiKeys lay inside in a tiny velvet sleeve.
A YubiKey 5C NFC and a backup key.
I laid them on the desk side by side.
At 11:45am I enrolled both keys as the hardware-key two-factor method on my Apple ID.
The Apple ID page took the first key on the USB-C port.
It asked me to tap to confirm.
I tapped.
It asked for the second key.
I plugged the second key in.
I tapped.
Hardware-key 2FA enabled.
The page generated a backup recovery code.
I copied the code to a piece of paper.
I walked downstairs to the basement.
The fireproof box from Costco sat on the shelf where I keep tax records.
I opened the box.
I placed the recovery-code paper inside.
I closed the box.
I walked back upstairs.
The entry-hall console no longer had the leather pouch on it.
The pouch was on the office desk.
The console now held the blue ceramic catch-all bowl and nothing else.
At 12:04pm I opened PNC business banking on the laptop.
I signed in with my hardware-key 2FA.
I navigated to Account Settings → Two-Factor Authentication.
I changed delivery from SMS to “In-App Push (PNC Mobile Banking).”
I confirmed.
PNC sent a test push notification to my phone.
I approved it.
At 12:09pm I called the PNC fraud-services line at the number on the back of my business debit card.
After a short menu I reached a fraud associate named Marisol Kline-Garner.
Marisol has been the sub-team supervisor on my business account for four years.
I said: “Marisol, this is Nadine Holloway. Account ending [last four]. I received the wire-flag email this morning. Both attempts were unauthorized. The attempting party is a relative who added himself as an Apple Trusted Contact and was reading my SMS 2FA codes via iCloud Messages mirror. I have already removed his access at the Apple level. I am calling to file the formal fraud case.”
Marisol said: “Nadine, I have your account open. Give me the details on the attempting party.”
I gave her Keith’s full legal name, his date of birth (I have it from family records), the destination account names from the email, and the timestamps.
At 12:14pm Marisol opened fraud case #PCB-2026-44218.
She said PNC would file the formal NACHA suspicious-transactions report.
She said PNC’s internal risk team would also issue a written banking-relations warning to Keith’s banking destinations.
She said the 72-hour wire hold would remain on my account until Tuesday.
She said the fraud case would resolve within fifteen business days.
I thanked her.
We hung up at 12:21pm.
I sat at the desk.
I opened my email.
I composed a one-paragraph note to my four highest-retainer clients.
I said: “Brief note — over the weekend I addressed an unauthorized access attempt on a personal Apple account that touched my business 2FA infrastructure. The issue has been resolved at Apple, at PNC, and at my email provider. No client data was accessed. No funds moved. I am rotating all client-shared credentials this week as a precaution. I will send each of you a new password manager invite by Wednesday. Apologies for the Sunday email.”
I scheduled the email to send at 7am Monday.
At 12:42pm Keith’s name came up on my phone.
He was calling.
I declined.
He called again at 12:43pm.
I declined.
He texted at 12:44pm: “Sis. Did you do something to your Apple ID.”
I did not respond.
He texted at 12:45pm: “Nadine. The Messages mirror just dropped. Are you okay.”
I did not respond.
He texted at 12:46pm: “Look. We need to talk before supper. Call me.”
I did not respond.
At 12:47pm I opened the iCloud account-security change log on my laptop one more time.
The log showed a sign-in attempt at 1:08pm Pacific from a device labeled “Keith’s MacBook Pro” using the Trusted Contact recovery flow.
The result column read: “Recovery contact not authorized for this Apple ID.”
I screenshotted the log entry.
I saved the screenshot to a folder on my desktop labeled “Holloway, K — 2026.”
I had not had a folder named that before.
I closed the laptop at 12:48pm.
I walked downstairs.
I made a sandwich.
I ate it standing at the counter.
I looked at the entry-hall console.
The pouch was no longer on it.
The blue bowl sat alone.
The Sunday Supper at our mother’s house began at five.
I would be there at five-thirty-five.
I had a bottle of wine.
I had time to change my shirt.
I went upstairs.
I changed.
I sat on the edge of the bed for one minute.
I stood up.
I went.
At one o’clock Sunday afternoon I called Tracey back.
She answered on the second ring.
She said: “How did the call go.”
I said: “Removal completed at 11:31. Sessions revoked. Keys enrolled. PNC fraud case opened at 12:14. Push 2FA enabled. Recovery code in the basement box.”
She said: “That’s the cleanest hour you’ve ever had.”
I said: “He called me three times between 12:42 and 12:46. Texted four times. He felt the mirror drop. He tried the recovery flow from his Mac at 1:08pm. The change log shows the attempt failed.”
Tracey said: “Send me the screenshot. I’ll keep a copy.”
I sent her the screenshot of the recovery-flow denial.
The screenshot showed “Recovery contact not authorized for this Apple ID” and a device label “Keith’s MacBook Pro.”
She wrote back two minutes later: “Logged. Are you going to supper tonight.”
I said: “I am.”
She said: “What’s the plan.”
I said: “I am going to eat dinner with my mother. I am going to say one sentence to Keith at the table if he forces the conversation. I am not going to merge the Facebook group and the bank account into one conversation. They are two conversations and I am keeping them apart.”
Tracey said: “Do you want me on call from 5 to 7.”
I said: “Yes.”
She said: “I’ll be at home with my phone on the kitchen counter. Text me one word if it goes sideways. I’ll call you back inside ten seconds.”
I said: “Thank you.”
She said: “Nadine.”
I said: “Yeah.”
She said: “He tried to take five thousand dollars from your business twice. He read your messages for ten weeks. Do not let him reframe this as a Facebook group disagreement at the dinner table. He will try. He is good at it. Don’t argue with the reframe. Just don’t accept it.”
I said: “I know.”
We hung up at one-fourteen.
I sat at the desk.
I opened the Sunday Supper Facebook group on my phone.
I had still been removed.
The group’s last post was a photo my mother had posted that morning — the pot roast in the slow cooker — with the caption “Five o’clock — pot roast and apple cobbler. Hope to see everyone.”
The post had nineteen likes.
One of the likes was Keith’s.
I did not request to rejoin.
I closed Facebook.
I migrated the eighteen business-critical accounts off SMS 2FA between 1:18pm and 3:42pm.
Stripe — onto authenticator app + hardware key.
Stripe took twelve minutes because they require a re-verification on the Stripe side.
GoDaddy — onto authenticator app + hardware key.
GoDaddy took six minutes.
DigitalOcean — onto hardware key only.
Two minutes.
Three cloud-hosting accounts — onto hardware key.
Two minutes each.
The file-sharing service my clients use — onto authenticator app.
Eight minutes.
My business email — already on hardware key; verified the recovery flow.
Two minutes.
PNC — already done.
A backup checking at Wells Fargo I had not used in eight months — onto in-app push.
Six minutes.
I did the migrations slowly and carefully.
I did not multitask.
I did not refresh email.
I did not look at my phone.
At 3:42pm I stood up from the desk.
My back ached.
I went downstairs.
I made a second sandwich.
I ate it standing at the counter.
I looked at the entry-hall console.
The blue ceramic catch-all bowl sat alone.
No leather pouch.
The pouch was upstairs on the desk.
At 4:02pm my mother called me.
I picked up on the third ring.
She said: “Nadine. Are you coming to supper.”
I said: “Yes, Mom. Five-thirty.”
She said: “Keith is going to be here at five.”
I said: “Okay.”
She said: “I don’t know what’s happening with the two of you.”
I said: “I know, Mom. I’ll be there. We can talk about it after dinner if you want, or we can not talk about it. Either way.”
She said: “Okay.”
She said: “Bring a bottle of the red you like.”
I said: “I will.”
She said: “Drive safe.”
I said: “I love you, Mom.”
She said: “I love you too, sweetheart.”
We hung up at 4:06pm.
I sat on the bottom step of the staircase for two minutes.
I thought about the Memorial Day picnic.
The picnic had been at Holladay Park in Beaverton because the city had repaved the parking lot near our usual park in Hillsboro.
Keith had grilled.
My mother had brought potato salad.
I had brought a fruit tart from a bakery on Hawthorne.
At one point in the afternoon Iris had run into the wading-pool area in her sundress and Linda had been on her feet in two seconds.
That was the afternoon Keith had said, “Sis, your phone has been crawling lately. Let me look.”
I had handed it to him.
He had walked to the picnic table beside the cooler.
He had sat down.
I had gone to help my mother carry plates to the trash.
I had been gone fifteen minutes.
When I came back he was scrolling Twitter on his own phone and mine was face down beside the napkin holder.
He had said: “Cleaned the photos cache. Should be smoother. Restart it tonight.”
I had said: “Thank you, Keith.”
I had hugged him.
He had said: “Anytime, sis.”
I did not think about that hug for ten more weeks.
I went upstairs.
I showered.
I changed into a black sweater and clean jeans.
I put the hardware-key pouch in the front pocket of my coat.
I did not need to bring it.
I brought it anyway.
The weight of the pouch in the pocket was small and steady.
I picked up the bottle of red — a Willamette Valley Pinot from a winery a former client had given me last December — from the kitchen counter at 5:22pm.
I locked the house.
I drove the seventeen minutes to Beaverton.
The drive on Sundays in October is quiet through Cedar Hills.
Most of the maple trees on Walker Road were turning.
A few had already dropped their leaves.
At five-thirty-two I turned onto my mother’s street.
I parked at the curb at five-thirty-five.
I sat in the car for ninety seconds.
I picked up the bottle.
I got out.
I locked the car.
I walked up the front walk.
Our mother’s house is on a quiet street in Beaverton.
A ranch-style three-bedroom built in 1973 with a covered front porch and a maple in the front yard that has been turning red since the last week of September.
I parked at the curb at five-thirty-five.
Linda’s car was in the driveway.
Keith’s car was at the curb behind it.
Two more cars I recognized as my cousins from Hillsboro.
I walked up the front walk.
I rang the bell once and let myself in.
The smell of pot roast in the kitchen.
My mother’s voice from the kitchen — Marlene Holloway, sixty-eight, retired elementary school librarian, widowed since 2018.
She was at the stove.
She turned when I came in.
She said: “Nadine. Come help with the carrots.”
She did not say anything else.
Keith was at the kitchen island.
He had a glass of red wine.
He looked up when I walked in.
He waited for me to say something.
I did not.
I set the bottle of wine I had brought on the counter.
I kissed my mother on the cheek.
I picked up a peeler.
I started on the carrots.
Linda was in the living room with her six-year-old daughter Iris and the cousins from Hillsboro.
The TV was on a college football game.
Volume low.
Keith said, after thirty seconds: “Hey, sis.”
I said: “Hey.”
He said: “Can I help with anything.”
I said: “I’ve got the carrots.”
He said: “Okay.”
He drank his wine.
He did not leave the kitchen.
He stood at the island.
He waited.
Iris came running into the kitchen.
Her hair was in two braids.
She had a stuffed rabbit in her arms.
She said: “Aunt Nadine. You weren’t on the call last Sunday.”
I said: “I know, sweetheart. I missed you.”
She said: “I made a card for you. It’s in my backpack.”
I said: “Bring it after dinner, okay.”
She nodded.
She ran out.
Marlene said, without looking up from the stove: “Five minutes on the carrots, Nadine.”
I peeled the carrots.
At five-fifty-two we sat down at the dining table.
Six adults and one child.
My mother at the head.
Keith on her right.
Me across from Keith.
Linda on my left with Iris in a booster seat next to her.
The two cousins from Hillsboro on the other side.
Pot roast.
Mashed potatoes.
The carrots.
A green salad.
A basket of rolls Linda had brought.
My mother said grace.
She thanked our father in the last line, the way she has every Sunday since 2018.
We all said amen.
Linda passed the potatoes.
Keith said: “Sis. Before we eat — can we talk a second.”
I said: “Pass the carrots, please.”
Keith said: “Nadine.”
Linda froze with the potato bowl in her hand.
My mother said: “Keith.”
Keith said: “Mom, I just want to clear something up.”
My mother said: “Keith. Eat your dinner.”
Keith said: “Mom — ”
I said: “Apple Support closed the unauthorized Trusted Contact at 11:31 this morning. PNC opened a fraud case at 12:14 this afternoon — case number PCB-2026-44218 — covering the August 18 and September 8 wire-transfer attempts. Both flagged. Neither completed. The hardware keys for my Apple ID are in my pocket. Mom, this is between Keith and me — you do not need to be in this conversation. Keith, you are not setting up another device of mine in your lifetime. You can come to Mom’s house. You will not be in my home alone. We will eat dinner now.”
I did not raise my voice.
The table was quiet.
Iris said, from the booster seat: “What’s a Trusted Contact?”
Linda said: “We’ll talk about it later, baby. Eat your potatoes.”
Keith opened his mouth.
My mother said: “Sit down, Keith.”
Keith was already sitting down.
He sat further down.
The pot roast was on the table.
I poured myself a glass of water.
I drank half of it.
The cousin from Hillsboro on the left — Patrick — said, after twenty seconds: “Pass the salt.”
Linda passed the salt.
We ate.
We ate for fourteen minutes without addressing the kitchen.
Then Keith put his fork down.
He moved into denial.
He said: “Nadine — whatever you’re thinking, I was *helping* you. I added the Trusted Contact at the picnic in case you got locked out. You’d thanked me for setting up your Apple TV. I assumed it was the same kind of favor.”
I did not respond.
I cut a piece of pot roast.
He moved into reframe.
He said: “Look, the bank stuff — that was a mistake. I was helping a friend move money for his small business and the routing went weird. I was going to fix it Monday. You acting like I was *taking* from you. Sis, we share a mother. We share a dad’s memory. You think I’d actually steal from you?”
I ate the piece of pot roast.
Linda said: “Keith.”
Keith ignored Linda.
He moved into accusation.
He said: “This is about the group. I knew it. Linda told you. Linda always told you everything. I am the moderator. I made one cleanup call. You’re using a tech misconfiguration to come after me in front of Mom on a Sunday. You’re going to make Mom cry. That’s on you.”
My mother said: “Keith.”
Her voice was not loud.
She said: “Keith. I am sitting here. I am not crying. Eat your dinner.”
Keith opened his mouth.
He closed his mouth.
He looked at me across the table.
He waited.
I said: “I was going to eat dinner with my mother. I am going to eat dinner with my mother. After dinner I am going to look at Iris’s card. I will be at Sunday Supper next week. You will be here. Mom will seat us across from each other. That is enough planning.”
The table held its breath for two seconds.
Patrick said, quietly: “Is anyone going to pass the rolls.”
Linda passed the rolls.
We ate.
At six-forty-one my mother stood up to bring out the apple cobbler.
Linda stood to help.
Iris brought her card from her backpack.
The card was a folded-up piece of construction paper with a stick-figure family on the front in markers.
I was the tall one with brown hair on the right.
Keith was not in the drawing.
I did not point that out.
I said: “Iris, this is the best card I’ve ever gotten.”
Iris said: “I know.”
She climbed back into her booster.
We had cobbler.
After dessert Linda stood up to start clearing the plates.
The cousins from Hillsboro stood to help.
Patrick rinsed.
Linda loaded.
Keith stayed at the table.
He drank the rest of his wine.
My mother poured herself a cup of decaf and sat back down.
Iris brought me her card on construction paper.
She climbed into my lap.
She pointed at the stick-figure of me on the right.
She said: “That’s you because of your hair.”
I said: “I love it, sweetheart.”
She said: “Mommy says I can come to your house and see the design computer next week.”
I said: “We’ll plan it with your mom.”
She nodded.
She slid off my lap.
She went into the living room with her stuffed rabbit.
Keith said, across the empty table: “Nadine.”
I said: “Keith.”
He said: “I’m going to call you this week.”
I said: “Don’t.”
He said: “Sis.”
I said: “Don’t call me this week. If you need to communicate with me, it goes through Mom or through Linda for the next month. I will tell you when I am ready to speak directly.”
He said: “What is the *month* for. We need to fix this. The longer it sits the worse it gets.”
I said: “The month is for me. Not for you.”
He stared.
He said: “Mom. Tell her this is unreasonable.”
My mother said, into her decaf cup: “Keith. I am drinking my coffee.”
Keith stood up.
He carried his wine glass to the sink.
He set it down.
He did not slam it.
He set it down.
He picked up his coat from the rack by the door.
He said: “Mom. I’ll call you tomorrow.”
He said: “Sis.”
He did not finish the sentence.
He walked out the front door.
The door closed quietly.
Linda looked at me from the kitchen.
She said: “Nadine — I should have called you on Friday. I shouldn’t have said ‘don’t make it a thing.'”
I said: “Thank you, Linda. We’ll talk later.”
She nodded.
I helped my mother dry the dishes.
I stayed until seven-forty.
The cousins left.
Iris hugged me at the door with the stuffed rabbit.
Linda put her hand on my shoulder for a count of three.
I left at seven-forty-three.
My mother walked me to the door.
She did not say anything in the hall.
She squeezed my arm once at the door.
She said: “Drive safe.”
I said: “I love you, Mom.”
She said: “I love you, sweetheart.”
I went.
I drove home through Cedar Hills.
The maple leaves were across Walker Road in patches.
I drove the speed limit.
At home I locked the door.
I hung my coat on the rack.
The hardware-key pouch was still in the pocket.
I took it out.
I walked upstairs to the office.
I set the pouch on the lowest drawer of my desk.
I did not put it back on the entry-hall console.
The console held the blue bowl, alone, the way it would hold the blue bowl for the next four weeks.
I went to bed at ten-twenty.
I did not check my phone again that night.
I slept for seven and a half hours.
I woke up Monday at five-forty-eight.
Three weeks later, on a Sunday at 10:14 in the morning, my mother called.
I picked up on the second ring.
She said: “Nadine. I’ve removed Keith as moderator of the Sunday Supper group. I’ve named you co-moderator with me. He stays in the group. He does not run it. I want to see you at supper tonight at five.”
I said: “Okay, Mom. I’ll be there.”
I did not ask her to explain.
She did not explain.
I went to supper at five.
Iris hugged me in the front hall.
She said: “Aunt Nadine, why didn’t you come last time? I missed you.”
I said: “I missed you too, sweetheart. I’m here now.”
Iris nodded.
She went back to her chair.
Keith was at the table.
My mother had seated him across from me.
He did not speak to me across the table.
He talked to Linda about her work in his polite voice.
We ate the chicken-and-rice.
My mother passed the rolls.
I helped Marlene cut the bread.
Tuesday morning, nine-thirty.
Sterling Coffee on Northwest 21st and Burnside.
Tracey is at the small two-top by the window.
Two cinnamon rolls and two cappuccinos on the table.
A man at the next table is reading a paperback novel and has not turned the page in twenty minutes.
The espresso machine hums.
The window faces Burnside.
This has been our standing Tuesday since the fall of 2019.
Tracey reviews my annual operating-account security audit, informally, on a napkin.
We have done it every year since.
I have moved my work life partway out of the home office.
In mid-September I rented a small private office at a co-working studio in downtown Portland.
Three private offices and a shared kitchen on the second floor of a brick building on Northwest Couch.
Two days a week I work from the co-working.
Three days a week from home.
I rented the office partly to be among people.
The leather pouch with the hardware keys is no longer on the entry-hall console.
The pouch lives in the small lockable cabinet under my co-working desk.
The keys are in it.
Tracey draws on a napkin.
She draws a small flow chart in pencil:
Apple ID → hardware keys
hardware keys → PNC
PNC → push 2FA
She writes “OK” beside each node.
I take the pencil.
I add one line at the bottom of the napkin:
“Marlene = co-moderator.”
Tracey looks at the line.
She draws a small star beside it.
She says: “How was supper last week.”
I say: “Quiet. Mom seated us across. He did not speak to me. He talked to Linda.”
Tracey says: “How long do you think it’ll be that way.”
I say: “I don’t know.”
She says: “You don’t have to know.”
I drink my cappuccino.
We talk about a Salem clinic that has asked me to refresh their patient-intake forms.
We talk about Tracey’s nephew’s college applications.
The man at the next table turns the page.
The cinnamon roll is warm.
The cup is heavy.
The PNC fraud case resolved on day twelve.
PNC issued Keith a written banking-relations warning under their suspicious-attempts protocol.
He is not banking-banned at PNC or at his own Wells Fargo, but he is flagged in PNC’s system.
PNC did not refer the case for criminal investigation.
I did not press for it.
Keith has not apologized.
He attends Sunday Supper.
He does not speak to me directly.
Linda has not apologized for the Friday DM about not making it a thing.
I have not asked her to.
At ten-eighteen Tracey closes the napkin into a cocktail-napkin square and slides it across the table.
I put the napkin in my bag.
I say: “Same time next Tuesday?”
Tracey says: “Same time.”
We both stand.
We both put on our coats.
We walk out together.
I unlock my bike from the rack on the curb.
I ride four blocks down Burnside.
I lock my bike outside my co-working building.
I walk up to the second floor.
I unlock the small cabinet under my desk.
The leather pouch is inside.
I do not need to open it today.
I close the cabinet.
I lock it.
I open my laptop.
A client email is at the top of the inbox.
The Salem clinic project lead is asking about a kickoff date.
I start replying.
I propose three Tuesdays in November.
I add a line at the bottom suggesting we set up hardware-key access for their three new admin staff.
I cite the 2019 incident, by way of context, in one sentence.
I send the email.
I check the time.
It is ten-thirty-one.
I open the next email.
