This.
I don’t know about that part.
Anything with a long enough paper trail and a lot of money will get found out eventually when the term “internal audit” appears in the story. Even if she hadn’t used her own bank account, and gaffed up a completely believable company, someone would double check that the company actually exists when they see a million dollars in billing.