Peter remembered Salum, who had worked with Hassan at a phone shop years before the investment talk began. Salum now repaired office equipment and still kept an old phone for music.
“I never invested,” he said. “Don’t put me on a claimant list.”
“We won’t,” Juma said. “We’re only trying to understand where these images began.”
Salum opened an old WhatsApp backup. Among jokes and small-business links was a familiar dark image: green figures, percentages and a line marked *weekly allocation*. Juma placed one of his recent screenshots beside it. The fonts had changed, but one typo—*perfomance*—was identical.
“At the time he used it as a personal tracker,” Salum said. “We used to laugh at that typo.”
“Can you verify the date?”
The file sat inside a years-old backup surrounded by dated messages. It had not been downloaded yesterday.
The discovery did not prove fraud. In fact it established something more precise: the template had begun as Hassan’s own tracking tool long before Juma invested. Later, images with the same design had been received by participants as balance and performance updates.
Salum found a voice note from those early days. Hassan’s younger voice said, “This is my board, not a broker screen. I use it to organize my numbers.”
With permission, they saved the artifact, its immediate context and the voice note—not the entire backup. Mariam asked that they record what the artifact did **not** prove: it did not show Juma’s money, current balance or Hassan’s later intention.
“The limitations stay next to the evidence,” she said. “Anger is good at deleting limitations from memory.”
They also saw how the template had changed. Early versions clearly showed columns like entry, target and notes. Later versions hid some of those columns and emphasized balance and percentage. The evolution could make a personal tracker look institutional to someone who did not know its origin.
At Bi. Nuru’s office, they showed Hassan both versions without staging a surprise.
“This old one was your tracker?” Juma asked.
“Yes.”
“And the new ones?”
“The same tracker, improved.”
“Why didn’t you make clear that they weren’t broker statements?”
“I never said the words ‘broker statement.’”
“Your messages said, ‘your account has reached this balance.’ We understood them that way.”
“Your understanding is not always my mistake.”
Bi. Nuru recorded the statement without deciding intention.
Juma did not send the two images around as a dramatic reveal. The older artifact changed the chronology, not the need for discipline.
Salum received a copy of the short note describing how his material would be used. He read it and laughed. “This is much less dramatic than I expected.” Juma said that was the point. They were not collecting a museum of suspicious things; they were answering defined questions. Bi. Nuru suggested recording a simple checksum and receipt date for the copied artifact so they could later distinguish the original file from edited working images. They did so without pretending to be forensic specialists. Provenance, she told them, was simply a disciplined way to remember what they actually saw.
When they finished, Salum locked the old phone away again. Juma did not ask to borrow it. If the artifact ever needed formal verification, Salum could produce the source device himself. Keeping custody with its owner was cleaner than turning Juma into the keeper of another person’s private history.
The template that later carried participants’ balances had existed years before Juma invested.
#