In June, 1991, Mary Hughes, the accounts-payable manager at the Wyatt Company, an employee-benefits consulting firm based in Washington, D.C., received a phone call from someone trying to reach the firm’s chief financial officer, Wilson H. Phillips, Jr., who goes by Woody. The person was calling from Associates Relocation Management Company, a firm in Texas, which Wyatt frequently used to relocate employees. Wyatt, they said, owed Associates forty-five thousand dollars. Hughes checked Wyatt’s system and determined that Associates had been paid. To prove it, she faxed the company a copy of the check. “They called back less than five minutes later,” Hughes recalled. “They told me the check had not been deposited into their bank account.”

Instead, it had been routed to an account in Maryland. Hughes called the Maryland bank that had cashed the check and submitted a fraud report to recoup the funds. “They gave me records saying who the account belonged to,” Hughes said. “And, sure enough, it was Woody’s.” In the next several hours, Hughes went through all of the payments Wyatt had made to Associates during the previous year, and she found multiple instances in which checks had been deposited into Phillips’s account. All told, Hughes discovered that Phillips had embezzled at least a million dollars from the firm.

Phillips was quietly fired, and no charges were brought against him. According to Hughes, the firm, fearing that it would lose customers, chose to keep the matter quiet. “Wyatt’s doors would have closed if the company prosecuted him,” Hughes said. “I mean, we were dealing with people’s money, and our C.F.O. was stealing.” (Since then, Wyatt has gone through a series of mergers. It is now part of Willis Towers Watson, which declined to provide a comment for this story.)

This story was published in partnership with The Trace, a nonprofit news organization covering guns in America.

For years, it troubled Hughes that Phillips got away with stealing money, particularly because he had then gone on to a long and lucrative career at the National Rifle Association, where he served as the chief financial officer and treasurer for twenty-six years. After reading a series of reports published by The Trace and The New Yorker, describing self-dealing and cronyism at the N.R.A. during Phillips’s tenure, Hughes decided to speak out. “Enough is enough,” she said. Three of Hughes’s former colleagues from Wyatt corroborated her story. All of them requested anonymity, out of fear of retaliation.

I reached out to Phillips and the N.R.A. for comment, and a spokesperson told me, by e-mail, “The NRA has no knowledge of the matters in question and, naturally, is not at liberty to comment on any issues that do not involve the NRA.” The spokesperson added, “With respect to his relationship with the NRA, Mr. Phillips was a longtime employee, and he continues to provide value to the Association and its members.” Phillips did not respond to requests for comment.

Hughes told me that the scale of Phillips’s duplicity had surprised her. She said that she had confronted Phillips soon after she found out about the questionable deposits in Maryland. “I said, ‘Woody, how the hell did this check get into a bank account in Maryland?’ And he said, ‘Mary, who else knows about this?’ ” Hughes left Phillips’s office and notified Wyatt’s controller that the company had a major problem on its hands. That evening, after Phillips had left for the night, Hughes returned to his office. She found copies of fraudulent invoices that he had submitted to her under the Associates name, which she had paid. Now she saw that they were cleverly crafted fakes, referencing legitimate activities that had never occurred. “It was a down payment on this, or the escrow on that,” she said. (The invoice for forty-five thousand dollars that led to Phillips being caught was a genuine bill from Associates; Phillips had apparently diverted the payment to his own account by mistake.)

Hughes later reviewed several years’ worth of records and found that Phillips had been generating fraudulent invoices in the names of at least two other Wyatt venders. The discovery left her badly shaken. “I saw that he started the scheme almost as soon as he walked into the door,” she said.

Less than a week after Hughes uncovered the fraud, Phillips returned to Wyatt for a meeting with lawyers. According to Hughes, he immediately paid the company five hundred thousand dollars, but he owed at least half a million more. Phillips made monthly interest payments on his balance to Wyatt until at least 2001, when Hughes was laid off.

By that time, Phillips had been overseeing the N.R.A.’s finances for nearly a decade. Philip Hackney, an attorney who used to work in the I.R.S. chief counsel’s office, told me that the disclosure of Phillips’s past fraud should trigger a close review of his work at the N.R.A. “A history of embezzlement means you can’t have confidence in anything that he’s done,” Hackney said. “Every transaction now merits serious scrutiny.”

Phillips held his role at the N.R.A. until 2018. According to annual reports filed with Massachusetts, Phillips, as the N.R.A.’s treasurer and chief financial officer, was solely responsible for “custody of funds,” “distribution of funds,” and “custody of financial records.” He was also one of two officials authorized to sign checks. Between 2005 and 2017, the years for which the organization's tax filings are publicly available, the N.R.A. paid Phillips more than ten million dollars.

Phillips, despite his role at the N.R.A., has mostly evaded scrutiny as details of financial misdeeds at the organization have emerged. In one internal N.R.A. memo from 2018, which was obtained by The Trace and The New Yorker, the nonprofit’s accountants singled out Phillips for “payments” the N.R.A. had made to his “significant other,” posing a conflict of interest. William Brewer III, a lawyer who represents the N.R.A., previously claimed that the payment was legitimate. “The N.R.A. hired an I.T. consulting firm with links to a social friend of Mr. Phillips,” he told me, via e-mail. “That firm was interviewed and vetted by the N.R.A.’s I.T. department, and its engagement was reviewed and approved by the audit committee.”

Phillips was also directly involved in another questionable business arrangement. While acting as the N.R.A.’s chief financial official, he simultaneously held the same position at Memberdrive, a short-lived marketing startup that brokered deals between membership organizations and businesses willing to pay royalties for their endorsements. One of Memberdrive’s top clients was the N.R.A.

When the startup began to struggle, Phillips tried to cut costs. On July 16, 2001, he sent an e-mail to his colleagues. The subject was “voluntary salary reductions,” and in his note he informed the staff that the company’s payroll would need to be reduced by “about 25%.” Those willing to voluntarily take cuts, he said, would receive stock options in exchange. He concluded, “The commitment of everyone to our making Memberdrive succeed is really appreciated, and these steps to manage our cash until a steady revenue stream is achieved should get us to a point where we all see the product of our sacrifices.”

Two of Phillips’s Memberdrive colleagues—both of whom received the e-mail—also had a direct connection to the N.R.A. One was Susan LaPierre, a Memberdrive executive and the wife of the N.R.A.’s executive vice-president and C.E.O., Wayne LaPierre. The other was Holly Marcario, the spouse of Robert Marcario, who at the time was the N.R.A.’s director of membership. Phillips, however, was the only official who worked for both entities. The N.R.A. spokesperson told me that the nonprofit “approved” of the arrangement because the “partnership benefited both organizations,” adding, “It was determined there was no conflict of interest.”

Hackney, the former I.R.S. attorney, said that Phillips’s dual roles presented “a glaring conflict of interest,” since Phillips could not fairly or effectively represent the financial interests of both organizations simultaneously. Instead, each organization should have had its own C.F.O. “It strikes me as completely illegitimate, just on its face, and it speaks of an absolute lack of controls,” Hackney said. “This guy’s job was to literally watch the money.”