Quick answer

An employer may investigate suspected employee fraud or falsified records, preserve relevant evidence, place the employee on preventive suspension when strictly justified, and impose discipline—including dismissal—if the charge is proved by substantial evidence. But suspicion, an audit discrepancy, an anonymous accusation, or the employee’s job title alone is not enough.

For dismissal based on fraud, dishonesty, or willful breach of trust, the employer must establish both:

A lawful and factually supported ground for dismissal; and
Procedural due process, ordinarily consisting of a detailed first written notice, a genuine opportunity to answer and present evidence, a fair evaluation of the defense, and a written decision.

The investigation should remain open-minded. Management should not issue a notice to explain merely to formalize a termination decision already made. A police complaint, prosecutor’s finding, or criminal conviction is not required before administrative discipline, but the employer must independently establish the employment offense through substantial evidence.

What conduct may justify dismissal?

Article 297 of the Labor Code recognizes the following just causes that may apply to employee fraud or falsification:

Serious misconduct;
Fraud or willful breach of the trust reposed by the employer or its authorized representative;
Commission of a crime or offense against the employer, an immediate member of the employer’s family, or an authorized representative; and
Other causes analogous to those expressly listed.

Depending on the facts, falsifying attendance logs, payroll records, expense claims, medical certificates, sales reports, receipts, inventory records, production data, qualifications, or approval documents may constitute serious misconduct, fraud, dishonesty, or breach of trust.

The label used by management is not controlling. The employer must prove the actual conduct and connect it to a lawful ground for discipline.

Fraud or breach of trust must be willful

A breach is willful when committed intentionally, knowingly, and purposely, without a justifiable excuse. An honest encoding mistake, misunderstanding, clerical error, system defect, or careless but unintentional act is not automatically fraud.

The Supreme Court has emphasized that loss of trust must rest on substantial evidence, not whims, suspicions, or uncorroborated accusations. The act must generally be work-related and must show that continued employment has become untenable.

Not every employee occupies a position of trust

Loss of trust and confidence generally applies to:

Managerial employees whose functions involve substantial discretion and responsibility; and
Fiduciary rank-and-file employees—such as cashiers, auditors, property custodians, or employees who regularly handle significant amounts of the employer’s money or property.

The employee’s actual duties matter more than the job title. A statement that “all employees are positions of trust” does not, by itself, satisfy the legal test.

For an ordinary rank-and-file employee, the employer must present evidence of the employee’s actual involvement in the alleged wrongdoing. Mere assertions or assumptions are insufficient. Even for a managerial employee, loss of trust cannot be invoked arbitrarily; there must still be a real and reasonable factual basis.

The required standard of proof

In an employment investigation, the employer must establish the offense through substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

This is lower than proof beyond reasonable doubt in a criminal case. Consequently:

The employer need not wait for a criminal conviction before deciding the administrative case;
An acquittal or dismissal of a criminal complaint does not automatically make an employment dismissal illegal; and
Conversely, merely filing a police, prosecutor, or court complaint does not automatically prove a valid employment ground.

The employer’s case must succeed on the strength of its own evidence. The employee’s failure to give a perfect explanation does not cure an unsupported accusation.

A legally defensible investigation process

1. Secure the evidence without prejudging the employee

As soon as a credible report is received, identify and preserve evidence that may be altered, overwritten, or destroyed. This may include:

Original paper and electronic records;
Audit trails, access logs, system timestamps, and transaction histories;
Relevant emails and work-related messages;
CCTV footage;
Receipts, vouchers, invoices, checks, and bank records lawfully available to the employer;
Specimen signatures or authenticated comparison records;
Inventory and custody documents;
Written statements from persons with direct knowledge; and
Applicable policies, job descriptions, approval limits, and process manuals.

Document who collected each item, when it was collected, where it came from, and whether it was copied or altered. Preserve original files and make working copies where possible. For electronic records, retain metadata and system-generated logs instead of relying only on screenshots.

Evidence should be collected lawfully and proportionately. Access to personal information must be limited to persons who need it for the investigation, with appropriate safeguards under the Data Privacy Act of 2012. An investigation does not give management unlimited authority to search an employee’s personal devices, private accounts, or unrelated communications.

2. Conduct a preliminary fact review

Before accusing a particular employee, determine:

What record appears false or altered;
What the accurate record should have been;
Who created, submitted, approved, accessed, or benefited from it;
Whether the system or workflow permits another person to make the entry;
Whether the discrepancy could have resulted from error, shared credentials, automation, or inadequate controls;
Which policy or legal duty may have been violated; and
Whether the available evidence reasonably connects the employee to the act.

Interview witnesses separately where practical. Ask for facts, not conclusions such as “I know the employee is dishonest.” Record whether the witness personally observed the event or learned it from someone else.

3. Decide whether preventive suspension is necessary

Preventive suspension is not a penalty. It may be imposed when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers. In fraud cases, this may apply where the employee could tamper with records, influence witnesses, repeat unauthorized transactions, or compromise important assets.

Preventive suspension should not be automatic merely because fraud is alleged. Consider less restrictive controls first, such as:

Temporarily removing system or payment authority;
Reassigning custody of funds or records;
Requiring dual approval;
Restricting access to particular locations or files; or
Temporarily transferring the employee to duties that do not compromise the investigation.

Under the implementing rules, preventive suspension generally must not exceed 30 days. If the employer extends the exclusion beyond that period while the investigation continues, the employee should ordinarily be paid wages and benefits during the extension. A collective bargaining agreement, employment contract, or company policy may provide greater protection.

The suspension notice should explain that the measure is preventive, identify the risk being addressed, state its effective date, and avoid declaring the employee guilty in advance.

4. Serve a detailed first written notice

If the preliminary evidence warrants a formal charge, give the employee a written notice stating:

The specific acts or omissions charged;
The relevant dates, transactions, records, amounts, or documents;
The employee’s alleged participation;
The company rules allegedly violated;
The applicable just cause under Article 297, if dismissal is being considered;
The possible disciplinary consequence; and
The deadline and method for submitting a written explanation and supporting evidence.

A notice stating only “fraud,” “dishonesty,” “falsification,” or “loss of confidence” is generally inadequate. The employee must receive enough factual detail to prepare an intelligent defense.

The employee should ordinarily receive at least five calendar days from receipt of the notice to explain. The period should be extended when reasonably necessary because of the volume or complexity of records, delayed access to documents, illness, or another legitimate circumstance.

Serve the notice personally with proof of receipt when possible. If personal service cannot be completed, use a reliable method allowed by law and company rules, including service at the employee’s last known address, and retain proof of delivery and attempted service.

5. Give meaningful access to the accusation and evidence

Due process is not satisfied if the employee is told to answer a vague charge while management withholds the records necessary to understand it.

Subject to legitimate confidentiality, privacy, security, and witness-protection concerns, provide or identify the material evidence supporting the charge. This may include relevant portions of audit findings, questioned documents, transaction data, attendance records, or witness allegations.

Where full disclosure would expose unrelated personal information or confidential business data, the employer may redact irrelevant details or provide a sufficiently detailed summary. The restriction should not make it impossible for the employee to defend against the charge.

6. Receive the employee’s explanation and evidence

The employee may:

Admit or deny the allegations;
Explain the relevant transaction or workflow;
Identify errors in the audit or record;
Submit documents, messages, reports, or system data;
Name witnesses;
Point to another person’s access or responsibility;
Explain an authorization, emergency, or established practice;
Question the authenticity or completeness of the evidence; and
Seek assistance from a representative, union officer, or lawyer.

An employee should answer factually and preserve a complete copy of the response and its attachments. A bare denial is less useful than a transaction-by-transaction explanation supported by records.

Refusal to sign a notice is not necessarily refusal to participate. The employer should document the attempted service through witnesses or other reliable proof. Silence likewise does not automatically prove guilt; the employer must still evaluate whether its evidence satisfies the required standard.

7. Hold a conference when necessary for a fair resolution

A formal courtroom trial is not required. However, an administrative conference should be conducted where:

The employee requests one in writing;
Material factual disputes require clarification;
Witness credibility or conflicting accounts are significant;
Company rules or a collective bargaining agreement require it; or
Management considers a conference necessary to resolve the case fairly.

At the conference, the employee should be allowed to explain the defense, present supporting evidence, identify material errors, and respond to the evidence relied upon by management. The employee may be assisted by a representative or counsel if desired.

Prepare accurate minutes stating who attended, the issues discussed, the evidence presented, and any agreed deadlines. Do not force the employee to sign inaccurate minutes or a prewritten confession.

8. Evaluate all evidence impartially

The decision-maker should assess:

Whether the questioned record is actually false;
Whether the employee created, altered, used, approved, or knowingly submitted it;
Whether the act was intentional;
Whether an innocent explanation is reasonably supported;
The reliability and consistency of witnesses;
The authenticity and completeness of electronic and paper records;
Whether other persons had access;
The employee’s actual duties and level of trust;
The seriousness and work-related effect of the act;
Applicable policies and past disciplinary treatment; and
Whether dismissal is proportionate under the facts.

Decision-makers should not rely on evidence that the employee was never meaningfully allowed to address. If the investigation discovers a substantially different offense, issue a supplemental notice and give another reasonable opportunity to answer before relying on it.

9. Issue a reasoned written decision

After considering the employee’s defense, serve a written decision stating:

The charge or charges resolved;
The material evidence considered;
The relevant findings of fact;
The treatment of the employee’s principal defenses;
The company rule and legal ground applied;
The penalty imposed and its effective date; and
Any internal appeal or grievance procedure available.

For dismissal, this is the second notice in the twin-notice process. It should show that management considered the circumstances before concluding that a lawful ground had been established.

Do not add old incidents that were not included in the first notice or that the employee had no opportunity to answer. Prior infractions may be considered only when lawfully relevant, properly documented, and consistent with the applicable policy and due-process requirements.

Must the employee admit personal gain?

No. Falsification may be serious even when the employee did not personally receive money. An intentionally false record can compromise payroll, regulatory compliance, safety, accounting, inventory, tax reporting, customer rights, or management decisions.

However, absence of personal gain may remain relevant to intent, gravity, motive, or the proper penalty. The employer must still prove knowing participation rather than infer fraud solely from an inaccurate record.

Is dismissal always the proper penalty?

No. Even when misconduct occurred, the penalty must be assessed in light of the particular facts. Relevant considerations may include:

The employee’s intent;
The nature and importance of the record;
Actual or potential loss;
The employee’s duties and authority;
Whether the act was isolated or repeated;
Concealment or attempted cover-up;
Prior valid disciplinary history;
Length of service;
The employer’s consistently applied rules; and
Whether continued employment remains reasonably possible.

Long service does not excuse deliberate fraud and can sometimes aggravate a betrayal of trust. But dismissal should not be imposed mechanically for a minor, inadvertent, or poorly supported discrepancy.

Company rules should identify offenses and corresponding penalties as clearly as practical. Enforcement must be consistent. Selectively punishing one employee while ignoring comparable violations by others may undermine the legitimacy of the decision.

Relationship to criminal proceedings

Administrative and criminal proceedings are separate.

An employer that discovers possible estafa, falsification, theft, cybercrime, or another offense may refer the matter to law-enforcement authorities. That does not replace the employer’s duty to observe labor due process.

Likewise:

A police investigation is not an employee disciplinary hearing;
An arrest does not prove an employment offense;
A prosecutor’s probable-cause finding is not the same as a criminal conviction;
The employer need not prove guilt beyond reasonable doubt in the labor case; and
The employer should not threaten baseless criminal charges merely to obtain a resignation, confession, repayment, or waiver.

If criminal exposure is possible, the employee should obtain independent legal advice before signing an affidavit or giving a statement intended for law enforcement. The employee’s response in the administrative case may affect later proceedings.

Resignation, restitution, and settlement

Repayment of a questioned amount does not automatically prove fraud, especially if payment was made under protest or simply to prevent disruption. Conversely, repayment does not necessarily erase a proven offense.

A resignation should be voluntary. An employer should not force an employee to sign a resignation letter, quitclaim, confession, promissory note, or authority to deduct wages as a condition for avoiding arrest or public accusation.

Any settlement should clearly distinguish among:

Restitution or disputed financial liability;
The employment relationship;
Final pay and statutory benefits;
Release or quitclaim terms; and
Possible civil or criminal proceedings.

Quitclaims are scrutinized closely. They are not automatically valid merely because they were signed and notarized.

Privacy and confidentiality during the investigation

Limit disclosure to people with a legitimate need to know, such as designated investigators, decision-makers, counsel, auditors, or regulators with lawful authority.

Avoid:

Announcing an unproven accusation to the workforce;
Posting the employee’s identity or alleged offense online;
Circulating investigation records beyond their legitimate purpose;
Accessing unrelated private files or communications;
Pressuring witnesses to adopt a preferred version; and
Retaining personal information longer than reasonably necessary.

Confidentiality cannot be absolute. The employee must receive enough information to answer the charge, and lawful disclosures may be required in labor, civil, regulatory, or criminal proceedings.

Evidence employers should preserve

Employers should maintain:

The original complaint or incident report;
The investigation authority and scope;
Evidence-preservation instructions;
Original and working copies of relevant records;
Audit methods and underlying data;
System-access and activity logs;
Witness statements and interview notes;
Job descriptions and authority matrices;
Applicable policies and proof that they were communicated;
The first notice and proof of service;
The employee’s response and attachments;
Conference notices, minutes, and recordings lawfully made;
Preventive-suspension records;
The written decision and proof of service; and
Records showing consistent treatment of comparable cases.

An audit conclusion should be traceable to its source data. A spreadsheet prepared for litigation is less persuasive if the original transactions, formulas, methodology, and responsible auditor cannot be identified.

Evidence employees should preserve

An accused employee should keep lawful copies of:

The notice to explain and termination or suspension notices;
The employment contract, handbook, code of conduct, and job description;
The written explanation and proof of submission;
Relevant emails, approvals, reports, receipts, and work messages;
Payslips, time records, and performance records;
Documents showing who had access to the relevant account or system;
Requests for documents, extensions, or a conference;
Names of witnesses with personal knowledge;
Proof of inconsistent treatment or retaliation, if applicable; and
Records of final pay and benefits.

Do not destroy, alter, backdate, or secretly remove confidential company records. Preserve only material that the employee may lawfully possess. A lawyer can help request records through proper procedures.

Common mistakes by employers

Treating an audit discrepancy as automatic proof of fraud;
Issuing a vague notice with no dates, transactions, or factual narrative;
Giving less than a reasonable period to answer;
Terminating the employee before receiving or evaluating the defense;
Relying on evidence gathered after the decision was already made;
Assuming job title alone establishes a position of trust;
Using preventive suspension as punishment;
Keeping the employee unpaid beyond the allowable preventive-suspension period;
Adding new charges only in the termination letter;
Relying entirely on a criminal complaint or police investigation;
Ignoring plausible evidence of shared access, system error, or authorization;
Applying penalties inconsistently; and
Publicly accusing the employee before the facts are established.

Common mistakes by employees

Ignoring the notice to explain;
Giving only a general denial;
Missing the response deadline without requesting an extension;
Deleting messages or altering records;
Signing a confession, resignation, or quitclaim without reading it;
Secretly taking unrelated confidential data;
Assuming that no criminal conviction means dismissal is impossible;
Failing to request material documents needed for the defense; and
Waiting too long before seeking labor or legal assistance.

Consequences of an improper dismissal

If the employer fails to prove a valid cause, the dismissal may be declared illegal. The usual statutory consequences include reinstatement without loss of seniority rights and full backwages. When reinstatement is no longer feasible, separation pay may be awarded in lieu of reinstatement, in addition to backwages, depending on the governing facts and final ruling.

If a valid just cause existed but the employer failed to observe procedural due process, the dismissal does not necessarily become illegal. The employer may nevertheless be ordered to pay nominal damages. The Supreme Court has commonly applied ₱30,000 for failure to observe due process in a dismissal for just cause, although adjudication ultimately depends on the controlling law and circumstances.

Other monetary awards, damages, attorney’s fees, or interest are not automatic and require an adequate legal and factual basis.

What an employee can do after suspension or dismissal

An employee who believes the investigation or dismissal was unlawful may:

Request copies of the notices, decision, and relevant employment policies;
Use any internal appeal, grievance machinery, or union procedure without missing external filing periods;
Submit a Request for Assistance under DOLE’s Single Entry Approach for mandatory conciliation-mediation;
If unresolved, file the proper complaint before the appropriate NLRC Regional Arbitration Branch; and
Obtain counsel promptly when the case involves large financial exposure, criminal allegations, digital evidence, retaliation, or disputed authorship of records.

A complaint for illegal dismissal is generally treated as an action for injury to rights subject to a four-year prescriptive period, while Labor Code money claims generally prescribe in three years from accrual. Do not wait for the deadline. Internal discussions, company appeals, or promises to reconsider may not safely stop prescription.

When legal help is urgent

Seek prompt legal assistance when:

The employee is being asked to sign a confession, resignation, quitclaim, or repayment agreement;
Police officers or prosecutors have become involved;
The questioned amount or regulatory exposure is substantial;
Records may soon be deleted under an automatic retention policy;
The employer plans forensic examination of devices or private accounts;
Preventive suspension is approaching or has exceeded 30 days;
The employee was dismissed without a detailed first notice;
Evidence suggests retaliation, discrimination, union interference, or selective prosecution;
The questioned document may have been created through shared credentials, identity misuse, or system compromise; or
A filing deadline may expire.

Practical investigation checklist

Before imposing dismissal, the employer should be able to answer yes to each material question:

Is there reliable evidence that the record was false or improperly altered?
Is the evidence attributable to this employee rather than merely to a shared account or workflow?
Is intentional misconduct shown, rather than only error or negligence?
Does the conduct fall under an identified company rule and lawful just cause?
If relying on loss of trust, does the employee actually occupy a qualifying position?
Was the employee given a detailed written charge?
Was the employee ordinarily given at least five calendar days to answer?
Was material evidence disclosed or sufficiently identified?
Was a meaningful conference provided when required or reasonably necessary?
Were the employee’s defenses genuinely evaluated?
Were new charges separately disclosed and answered?
Is the penalty proportionate and consistent with comparable cases?
Does the written decision explain the findings and basis for the penalty?
Can the employer produce the complete investigation record if the dismissal is challenged?

If a material answer is no, the investigation should ordinarily be completed or corrected before dismissal.

Frequently asked questions

Can an employee be dismissed for submitting a fake medical certificate?

Possibly. The employer must prove that the document was false and that the employee knowingly submitted or used it dishonestly. A verification problem, clinic error, or unauthorized alteration by another person should be investigated before attributing fraud to the employee.

Is a notice to explain the same as a termination letter?

No. The first notice states the detailed accusation and invites a defense. The second notice communicates the decision after the evidence and defense have been considered. Combining them in a document that treats dismissal as final may defeat the purpose of due process.

Can the employer terminate the employee immediately after receiving the explanation?

Only after genuinely evaluating the explanation and the complete evidence. The law does not impose a fixed waiting period between the response and decision, but a decision that was plainly prepared in advance may indicate that the opportunity to be heard was meaningless.

Does the employee always have a right to a lawyer during the company investigation?

The employee must be allowed assistance by a representative if desired in the due-process setting contemplated by the Labor Code and applicable rules. A company investigation is not a criminal trial, and the employer is not ordinarily required to provide or pay for the employee’s lawyer.

Can an employee refuse to attend the conference?

The employee may decline or fail to attend, but should understand that the employer may decide based on the available evidence after a properly given opportunity. It is usually better to respond in writing, state any objection, and request a reasonable alternative schedule if attendance is genuinely impossible.

Is an anonymous complaint enough to dismiss an employee?

No. It may justify a preliminary inquiry, but dismissal must rest on independently verified substantial evidence, not the anonymous allegation alone.

Can CCTV, emails, and system logs be used?

Yes, when relevant, authentic, lawfully obtained, and fairly presented. Their weight depends on completeness, accuracy, custody, context, access controls, and whether the employee had a meaningful opportunity to respond.

Must the employer report suspected falsification to the police?

Not in every case. Whether to file a criminal complaint depends on the facts, applicable law, corporate duties, regulatory obligations, and available evidence. Internal discipline and criminal prosecution are separate decisions.

Can the employer deduct the alleged loss from final pay?

Not automatically. Wage deductions are regulated and require a lawful basis. A disputed allegation of loss does not by itself authorize unilateral deduction of any amount the employer chooses.

Does procedural compliance cure a weak fraud case?

No. Perfect notices and hearings cannot replace proof of a valid cause. Substantive and procedural due process are separate requirements.

Official legal references

This article provides general legal information, not legal advice or a finding on any particular employee or investigation. The validity of discipline depends on the evidence, employment duties, company rules, applicable collective bargaining agreement, notices, and complete procedural record. Sources and procedures were checked as of August 24, 2026.