Explore

His signature is on the receipt. Did he steal it or move it to safety?

Start with physical evidence that permits two explanations, then let the character test one detail.