She pressed.

She didn’t click.

She pressed the button.

The device flickered to life. Not with the usual six-digit code she remembered, but with words, crawling across the screen one letter at a time. INSERT CARD. Priya frowned. The Secure Key never asked for a card. It was just a token generator. She ignored it, pressed again. INSERT CARD. Her hands were cold now. From the drawer, she pulled her old debit card—expired three years, corners bent. On instinct, she slid it into the side of the device. There had never been a slot there before. But there was now.

Priya sat in the dim kitchen, holding the dead Secure Key like a talisman. Her phone buzzed one last time. Her bank’s real app. Balance: exactly what it should be. Plus the reversed charges. Plus a single new transaction she hadn’t made.

The email she never clicked was gone. The drawer was closed. And in her hand, the Secure Key’s screen glowed faintly—just for a second—showing a single word: WATCHING. Priya put it back in the drawer. Slowly. And locked it.

Then: CARD ACCEPTED. YOU ARE NOT THE FIRST TO IGNORE THE NEW PROMPTS. YOU ARE THE FIRST TO USE THE OLD WAY. The device vibrated in her palm—a low, purposeful hum. The house lights flickered. Her phone buzzed with another email, then another. Five in quick succession. All from her actual bank. All saying: “Funds transferred.” All fraudulent.