Mickey Gibson is a single mother of two toddlers, Tommy (three) and Darby (two), living in Williamsburg, Virginia. A former standout college basketball player and theater major at Temple University in Philadelphia, she later became a police forensic technician, uniformed officer, and detective in Jersey City, New Jersey. Her ex-husband cleaned out their bank accounts and abandoned her while she was pregnant with Darby, forcing her to leave the police force and relocate near her retired parents, Rick and Dorothy Rogers. She now works from home for ProEye, a global private investigation firm specializing in tracking hidden assets.
Shortly after Gibson locates $200 million in hidden bank accounts for ProEye, she receives a call from a woman identifying herself as Arlene Robinson, supposedly a new ProEye employee. Robinson directs Gibson to Stormfield, a sprawling mansion near Smithfield, Virginia, to inventory its contents for creditors. Robinson's knowledge of Gibson's earlier conversation with her supervisor eliminates Gibson's suspicions. At the mansion, Gibson discovers a hidden passage behind a partially open wall in the library and, following it, finds the decomposing body of an elderly man in a secret room.
Virginia State Police detective Wilson Sullivan takes charge of the investigation. He reveals that Robinson's property history was fabricated and that the dead man is the home's actual owner, Daniel Pottinger. When ProEye confirms no one named Robinson works for them, Gibson realizes she was manipulated into finding the body.
A burner phone appears on Gibson's porch. The mysterious woman calls, refusing to give her real name but claiming she found Pottinger's body first and could not go to the police. She asks Gibson to investigate the murder, saying the killers will target her next. Gibson keeps these contacts secret from Sullivan.
Using her forensic training, Gibson lifts fingerprints from the Stormfield mailbox and has a former colleague identify them. The dead man is Harry Langhorne, a former bookkeeper for the Giordano crime family in Trenton, New Jersey, who turned state's evidence decades earlier, helped dismantle several mob families, and disappeared into the federal Witness Security Program (WITSEC) with his wife, Geraldine, and their children, Douglas and Francine.
The mysterious woman, now calling herself Clarisse, is revealed to be a sophisticated con artist operating from a room filled with labeled notebooks, including one titled MICKEY GIBSON AND THE PLAN. She runs blackmail schemes and investment scams while methodically managing Gibson as a project. She provides Gibson with a list of Pottinger's criminal associates, including Nathan Trask, a powerful crime lord based in Virginia Beach.
Gibson and Sullivan meet with US Marshal Earl Beckett, who supervised the Langhorne family at their final WITSEC location in Albuquerque, New Mexico. Beckett reveals that Langhorne abandoned his family roughly 20 years earlier, his wife disappeared shortly after, and the children left WITSEC when Francine turned 18. Sullivan shares that Langhorne was poisoned with botulinum toxin, restrained while dying, and was terminally ill with brain cancer. Near the body, the phrase "DO AS I SAY, NOT AS I DO" was written on the wall in what Gibson determines to be two different hands.
Gibson visits Sam Trask, Nathan's 80-year-old father, a retired FBI agent still investigating his son from an assisted living facility. Sam becomes Gibson's ally. Clarisse separately meets Nathan Trask and negotiates a finder's fee to recover money she claims Pottinger stole from him.
When Gibson discovers another murder in The Plains, Virginia, with the same phrase on the wall, she and Sullivan investigate. The victim's birth name was Bruce Dixon, and the Dixon family were WITSEC neighbors of the Langhornes. Gibson finds a Superman comic book with the initials BD and RE inside a drawn heart and learns that a woman using the alias Julia Frazier—another of Clarisse's cover identities—was present when the body was found.
Gibson is kidnapped by Trask's operatives, threatened with a garrote, and forced to agree to find money Langhorne stole from Trask. They warn that disclosure will result in her family's death. Gibson decides her only path forward is to solve the case herself.
Through a chain of clues, Gibson deduces Clarisse's true identity. She connects Clarisse's offhand mention of "day care for children and parents" to an overheard call in which someone addressed Clarisse as "Ms. Frazier" and reported a woman missing. A reporter reveals that Geraldine Langhorne's legal first name was Agnes, and Gibson finds a report about an Agnes Leland vanishing from an assisted living facility in Greenville, South Carolina. Using a voice stress analyzer during a phone call, Gibson confronts Clarisse as Francine, and the spiking stress indicators confirm the identification.
Shaken by mounting threats, including an attack by Rochelle Enders, a woman from her WITSEC past who has kidnapped Agnes and killed Bruce Dixon, Francine requests a face-to-face meeting at Gibson's home. Over coffee, she shares a clue from Stormfield suggesting the treasure is stored digitally rather than physically buried, asks Gibson to investigate Sullivan's background, and departs, telling Gibson: "You had everything, Mickey. Everything. And you pissed it away."
At Francine's request, Gibson investigates Sullivan and finds no records of him before he joined the police force. She obtains his fingerprints, and the FBI identifies him as Mark Gosling. His sister Helen was a WITSEC protectee who died by apparent suicide after Beckett raped her. Sullivan confirms he has been following Beckett from post to post for years, changing identities to build a case against the marshal.
During a pivotal meeting, Francine reveals her full history. Her father and Darren Enders, Rochelle's father, became close friends in WITSEC and forced their underage daughters into sex work, secretly filming encounters for blackmail and compelling the girls to steal from clients. Francine was first sexually exploited at 13, and the abuse left her unable to have children. WITSEC marshals, including Beckett, were complicit. Francine reveals she attended Temple during Gibson's time there and was the woman Gibson once saved from an attacker on campus. Her obsession with Gibson grew from watching someone who had a loving family and extraordinary talents, representing everything Francine could never have.
Gibson, Francine, and Sam Trask execute a sting against Nathan Trask. Francine enters his compound posing as a cryptocurrency expert and performs a fake bitcoin transfer on his laptop while secretly installing keystroke-tracking software. The FBI captures his financial records, and Trask is arrested.
They then trap Beckett at Stormfield with fake treasure. Upon seeing trunks of apparent cash, Beckett draws his gun and confesses to poisoning Langhorne. Sullivan and officers emerge from hiding, but Beckett's accomplice Darren Enders opens fire, killing one officer and wounding Sullivan. Doug Langhorne, Francine's brother, who has been surveilling Stormfield with Rochelle in hopes of finding the treasure, tackles Enders. Gibson wounds Beckett. Enders fires at the fleeing Francine but accidentally kills Rochelle. FBI Agent Cary Pinker arrives and prevents Beckett from shooting Gibson.
Gibson and Francine decode cryptic messages Langhorne left behind. Using substitution cipher logic, they trace the treasure to 199 Button Road in Yarden, New York, Langhorne's childhood home. Inside the climate-controlled house, they discover walls covered with stolen masterwork paintings by Van Gogh, Degas, Monet, Vermeer, and others. The museums and collectors whose works were stolen pay generous finder's fees.
Beckett and Enders accept plea deals guaranteeing they will die in prison. Sullivan recovers and resumes his career. Francine reunites with her brother Doug and places Agnes in a nearby facility with full-time care. She visits Gibson's home to meet the children, and Gibson offers her the role of honorary aunt, proposing they continue working together. Francine accepts, and Gibson tells her it is time to start calling her "Mick," the name reserved for the people she cares about.