Quick answer

A private employer in the Philippines may investigate suspected employee fraud or falsified records, preserve evidence, restrict access to sensitive systems, and impose discipline when justified. But an accusation, audit discrepancy, or loss of confidence by itself is not enough to dismiss an employee.

A lawful dismissal generally requires both:

Substantive due process: a just cause under Article 297 of the Labor Code, supported by substantial evidence; and
Procedural due process: a specific written charge, at least five calendar days from receipt to explain, a meaningful opportunity to be heard, and a written decision issued only after considering the employee’s defense.

A clerical mistake, unexplained discrepancy, or mere suspicion is not automatically fraud. The evidence must establish the employee’s participation and the intent or other elements required by the particular ground invoked.

These rules principally cover private-sector employment. Government personnel, seafarers, kasambahays, and workers governed by special laws or contracts may be subject to additional or different procedures. A collective bargaining agreement, employment contract, or company policy may also provide greater protection and must be checked before action is taken.

What must be proved before dismissal

Article 297 of the Labor Code recognizes several just causes potentially relevant to fraudulent transactions or falsified records.

Fraud

Fraud is separate from willful breach of trust. It generally requires an act, omission, or concealment involving a breach of a duty, trust, or confidence, committed against the employer or its representative in connection with work.

The Supreme Court has explained that fraud or dishonesty justifies dismissal when the employee commits a dishonest act reflecting a disposition to deceive, defraud, and betray the employer. An inaccurate entry is not necessarily fraudulent if it resulted from an honest error, misunderstanding, system defect, or authorized correction. Intent must be evaluated from reliable facts, not assumed from the discrepancy itself.

Willful breach of trust

When the ground is loss of trust and confidence, the employer must establish that:

The employee held a position of trust and confidence; and
The employee committed a real, work-related, and willful act justifying the loss of trust.

Positions of trust include managerial personnel and rank-and-file employees who routinely handle significant money or property, such as cashiers, auditors, and property custodians. The actual duties matter more than the job title.

The breach must be intentional, knowing, and purposeful, without justifiable excuse. For rank-and-file employees, the employer must prove actual involvement; uncorroborated accusations are insufficient. Loss of trust cannot be simulated, used as a pretext, or raised after the fact to justify a decision already made.

Serious misconduct

Falsifying time records, reimbursement documents, inventory reports, payroll data, or transaction records may constitute serious misconduct when the employer proves:

Wrong or improper conduct;
A grave and aggravated character;
A connection to the employee’s duties;
Wrongful intent; and
Conduct showing that the employee has become unfit to continue working for the employer.

Not every policy violation reaches this level. The nature of the record, the employee’s purpose, the effect on the business, and the surrounding circumstances remain important.

No automatic peso threshold

The Labor Code sets no universal minimum loss that automatically makes fraud dismissible. Actual financial loss is relevant but is not always indispensable; an intentional falsification may seriously compromise payroll, safety, regulatory, financial, or customer records even if discovered before money is lost.

Conversely, a shortage or discrepancy does not automatically prove fraud. The employer must still establish the employee’s responsibility and the elements of the stated ground. The employee’s role, intent, prior record, benefit obtained, harm or risk created, company rules, and proportionality of the penalty should all be considered.

The required level of evidence

In an illegal-dismissal dispute, the employer bears the burden of proving the valid cause for dismissal. The applicable standard is substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

This is lower than proof beyond reasonable doubt, but it still requires evidence rather than suspicion, conjecture, or a bare accusation. Direct evidence is not always necessary; credible circumstantial evidence may be sufficient when the proven circumstances form a logical and reliable connection to the employee.

The evidence should answer practical questions such as:

What entry, document, transaction, or representation was false?
What should the correct information have been?
Who created, approved, altered, submitted, or benefited from it?
How is the employee connected to the act?
Was the conduct intentional or reasonably explainable as an error?
Did another person have the same credentials, access, authority, or opportunity?
Are the audit method and underlying source data reliable?
Do the employee’s explanation and supporting records change the conclusion?

The Supreme Court’s decisions in Bance v. University of St. Anthony and Musahamat Workers Labor Union-1-ALU v. Musahamat Farms, Inc. illustrate both sides of the rule: proven fraudulent participation may support dismissal, while weak or unreliable accusations do not become substantial evidence merely because an employer labels them loss of trust.

A fair investigation, step by step

1. Stop further loss without deciding guilt

Secure affected funds, documents, inventory, databases, credentials, and approval channels. Consider temporary access restrictions, dual approvals, reassignment, or supervised work.

Describe these as protective measures, not punishment. Internal announcements should not call the employee a fraudster or falsifier before the evidence has been evaluated.

2. Define the allegation precisely

Identify the transaction, record, date range, system, policy, and suspected act. Avoid an unlimited search through the employee’s history merely to find some basis for dismissal.

An investigator should have no material conflict of interest. Where practicable, separate the investigator from the final decision-maker, especially if the investigator is also the complainant or alleged victim.

3. Preserve reliable evidence

Preserve, as applicable:

Original paper records and properly identified working copies;
Native electronic files and their metadata;
Audit trails, access logs, change histories, and approval records;
Relevant emails and work-platform messages;
CCTV footage before routine overwriting;
Payroll, attendance, inventory, bank, point-of-sale, and reimbursement records;
Applicable policies, prior versions, and proof that they were communicated;
Witness statements based on personal knowledge; and
Evidence supporting the employee’s explanation, not only evidence pointing toward guilt.

Record when evidence was collected, by whom, from what source, and who later accessed or altered it. Do not overwrite the original file, edit a screenshot, or rely only on an undocumented spreadsheet summary when source records are available.

Electronic records may later require authentication. The Supreme Court’s Rules on Electronic Evidence place the burden of proving authenticity on the party presenting an electronic document.

4. Collect information lawfully and proportionately

The Data Privacy Act of 2012 does not prevent a legitimate workplace investigation, but processing must have a lawful basis and remain necessary, proportionate, transparent, secure, and limited to the stated purpose.

Ownership of a work device does not create unlimited authority to enter an employee’s personal email, cloud storage, or social-media account. Review the employer’s acceptable-use and monitoring notices, collect only relevant information, restrict access to the investigation team, and retain the material only as long as lawfully necessary.

The National Privacy Commission recognizes legitimate workplace monitoring in appropriate circumstances but stresses the need to balance business interests with employee rights and the general privacy principles.

5. Interview witnesses carefully

Interview witnesses separately where possible. Record who was present, the questions asked, and whether the statement was read and understood before signing. Distinguish firsthand knowledge from rumor or inference.

Avoid threats, humiliation, promises of immunity, or pressure to sign a prepared confession. An admission should be voluntary, specific, and read in a language the employee understands.

6. Test alternative explanations

Before issuing a charge, examine possibilities such as shared credentials, delegated work, system migration errors, duplicate transactions, misunderstood procedures, authorized adjustments, defective equipment, or another person’s access.

An investigation should determine what happened; it should not merely assemble support for a predetermined outcome.

When preventive suspension is allowed

Preventive suspension is not an automatic response to every fraud allegation. It is permissible when the employee’s continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. In a fraud investigation, this may exist when the employee retains access to money, inventory, sensitive records, or systems and could repeat the act, alter evidence, or obstruct the investigation.

Under the Omnibus Rules discussed by the Supreme Court in Lagamayo v. CGI Glass Lewis Workforce Services, Inc.:

Preventive suspension may be unpaid when justified;
It may not exceed 30 days for the offense under investigation;
After 30 days, the employee must be returned to the former or a substantially equivalent position, or the suspension may be extended with wages and benefits; and
Amounts paid during an extension cannot be recovered from the employee merely because dismissal is eventually imposed.

An unjustified, indefinite, or excessively prolonged suspension may amount to constructive dismissal. Where access controls, temporary reassignment, remote work restrictions, or supervised duties adequately address the risk, those less disruptive measures should be considered.

The first written notice: a proper notice to explain

Once dismissal is being considered, the employer must issue a first written notice, commonly called a notice to explain or NTE. Under DOLE Department Order No. 147-15, it should contain:

The specific just cause or causes under Article 297;
The company rule, contract provision, or policy allegedly violated, if applicable;
A detailed narration of the material facts and circumstances;
The particular acts or omissions attributed to the employee; and
A directive to submit a written explanation within a reasonable period.

A reasonable period means at least five calendar days from receipt of the notice. This is intended to allow the employee to study the charge, consult a union officer or lawyer, gather evidence, and prepare a defense. The period should not be shortened simply because management wants an immediate decision.

“Fraud,” “dishonesty,” “falsification,” or “loss of trust” without the supporting who, what, when, where, and how is generally inadequate. The employer should preserve proof of service. The required notices must be served personally or at the employee’s last known address.

A verbal accusation, audit conference, or preventive-suspension notice is not a safe substitute for a proper first notice unless the document itself substantially contains the required charge and opportunity to explain.

The employee’s opportunity to be heard

The employee must receive a meaningful chance to:

Deny, admit, or clarify each material allegation;
Explain how the disputed record was created or changed;
Present documents and identify witnesses;
Challenge the accuracy or interpretation of audit findings; and
Point out inconsistent treatment, authorization, system problems, or other defenses.

A written explanation may satisfy the hearing requirement. A trial-type hearing is not automatically required. However, a formal hearing or conference becomes mandatory when:

The employee requests one in writing;
Substantial evidentiary disputes exist;
Company rules, established practice, or a CBA requires it; or
Similar circumstances make a hearing necessary for a fair resolution.

At a conference, the employee should be allowed assistance from a representative or counsel of choice. There is no absolute right to confront or cross-examine every witness in a company administrative investigation, but the employee must receive enough detail and a genuine opportunity to answer the material case.

If the employee fails or refuses to explain after valid notice and a real opportunity, the employer may decide based on the available evidence. Silence, however, does not cure a weak investigation and should not be treated as automatic proof of fraud.

The written decision

After the response period and any required conference, the employer must impartially evaluate the entire record, including evidence favorable to the employee.

If discipline is warranted, the penalty should be consistent with the proven charge, the company’s rules or CBA, comparable cases, the employee’s duties and record, and the seriousness of the misconduct. The termination notice should:

Identify the findings actually established;
Address material defenses;
State the just cause and applicable rule;
Confirm that all relevant circumstances were considered;
Explain why dismissal, rather than a lesser sanction, is justified; and
State the effective date.

The employer should not dismiss the employee for a materially different accusation that was never included in the first notice. A new charge normally requires a new notice and opportunity to answer.

Employment and criminal proceedings are separate

An employer need not wait for a criminal conviction before completing a workplace investigation. Labor proceedings use substantial evidence, while criminal conviction requires proof beyond reasonable doubt. An acquittal or dismissal of a criminal complaint therefore does not automatically resolve the employment case, and a valid internal finding does not establish criminal guilt.

Likewise, filing a police or prosecutor’s complaint does not replace the twin-notice process. Employment discipline and criminal prosecution must each satisfy their own requirements.

An employee facing possible falsification, estafa, theft, cybercrime, or other criminal exposure should obtain legal advice before signing an admission, repayment agreement, waiver, or affidavit. A private HR interview is not automatically a custodial investigation, but if law-enforcement officers begin custodial questioning, constitutional protections and Republic Act No. 7438 become immediately important.

Practical steps for an accused employee

Record the date and manner of receipt. The five-calendar-day response period runs from receipt, not from the date printed on the notice.
Request clarification promptly. If the charge is vague, ask in writing for the transaction details, dates, policies, and material records needed to respond.
Preserve evidence lawfully. Keep the NTE, suspension notice, emails, payslips, schedules, approvals, policies, and documents already lawfully in your possession. Do not secretly remove confidential company data.
Prepare a point-by-point explanation. Separate admitted facts, disputed facts, lack of knowledge, system issues, authorization, and supporting documents.
Request a conference in writing when needed. State the evidentiary disputes and ask to bring a union representative, trusted representative, or lawyer.
Do not alter or delete records. Deletion after notice can create a separate issue and damage an otherwise valid defense.
Do not sign something untrue. Ask for time to read any confession, resignation, quitclaim, or repayment agreement. Request a copy of everything signed.
Seek counsel quickly if criminal exposure is realistic. A detailed employment explanation can later become evidence in another proceeding.

Common mistakes

By employers

Treating an allegation or audit exception as established fraud;
Using a generic NTE with no dates, transactions, or specific acts;
Giving fewer than five calendar days from receipt to respond;
Deciding to dismiss before receiving the explanation;
Ignoring exculpatory documents or credible alternative explanations;
Using preventive suspension as punishment or allowing it to exceed 30 days without paid extension or reinstatement;
Introducing new grounds only in the termination letter;
Relying on altered screenshots, unsupported summaries, or anonymous accusations without corroboration;
Accessing personal accounts or disclosing investigation details unnecessarily;
Forcing a resignation or confession; and
Automatically deducting an alleged loss from wages or final pay without a lawful basis.

Wage deductions are restricted by Article 113 of the Labor Code. An allegation of employee liability does not by itself authorize unilateral recovery from earned wages.

By employees

Ignoring the NTE because it appears unfair;
Responding only orally when a written explanation was requested;
Making unsupported accusations instead of addressing the evidence;
Deleting messages, files, or logs;
Coordinating stories with witnesses;
Taking confidential records unrelated to the defense; and
Signing a resignation, quitclaim, or admission without reading it or obtaining advice.

Consequences of getting due process wrong

If no just cause is proved, the dismissal is illegal. The usual remedies may include reinstatement without loss of seniority rights and full backwages, although separation pay may be ordered instead when reinstatement is no longer feasible.

If a just cause is proved but the required procedure was not followed, the dismissal generally remains effective, but the employer may be ordered to pay nominal damages. The Supreme Court has repeatedly applied ₱30,000 for failure to observe procedural due process in a just-cause dismissal, including in its 2025 decision in Villarico v. D.M. Consunji, Inc..

Bad-faith, oppressive, or malicious conduct may create additional exposure depending on the evidence. Illegal dismissal alone does not automatically prove bad faith.

After separation, DOLE guidance generally calls for final pay within 30 days from separation unless a more favorable policy or agreement applies, and a certificate of employment within three days from the employee’s request. See Labor Advisory No. 06-20.

When legal help is urgent

Seek assistance promptly when:

The employee has been dismissed without a written charge or decision;
Preventive suspension is unjustified, indefinite, or beyond 30 days without reinstatement or pay;
Management is demanding an immediate confession, repayment, resignation, or quitclaim;
Police, prosecutors, the NBI, or another law-enforcement agency has become involved;
Evidence may soon be deleted or overwritten;
Personal accounts or devices were accessed without clear authority;
The case involves senior officers, significant losses, regulated records, or multiple employees;
Retaliation, union discrimination, or whistleblower issues may be present; or
A CBA grievance or appeal deadline is approaching.

Workers and employers may file a Request for Assistance through DOLE’s Single Entry Approach (SEnA). It provides a 30-day mandatory conciliation-mediation process, with onsite filing at participating DOLE, NCMB, and NLRC offices and online filing through the DOLE Assistance for Request Management System.

An illegal-dismissal action generally has a four-year prescriptive period, while many money claims arising from employment prescribe in three years. These are outer limits, not recommended waiting periods; different claims and agreements may carry shorter operational or grievance deadlines.

Frequently asked questions

Is a formal administrative hearing always required?

No. A meaningful written opportunity to answer may be sufficient. A hearing or conference becomes mandatory when requested by the employee in writing, when substantial evidentiary disputes exist, when a company rule or CBA requires it, or when similar circumstances justify it.

Can an employee be suspended immediately?

Only when continued employment poses a serious and imminent threat to life or property. The employer should identify the actual risk and consider whether restricted access or temporary reassignment would be sufficient. The initial preventive suspension cannot exceed 30 days.

Is one falsified record enough for dismissal?

Possibly, but not automatically. The result depends on proof of authorship or participation, intent, the employee’s duties, the importance of the record, the benefit or risk created, company rules, proportionality, and the surrounding facts. An honest error is not fraud.

Must the employer show an actual monetary loss?

Not in every case. A deliberate falsification may seriously compromise the employer even if detected before payment or loss. But the absence of actual loss may affect the seriousness and proportionality analysis, and intent and responsibility must still be proved.

Can the employer inspect work email or a company device?

Potentially, if the review has a lawful basis, falls within a communicated policy or legitimate and proportionate business purpose, and complies with the Data Privacy Act. Ownership of the device does not automatically authorize unrestricted access to personal accounts or unrelated private communications.

Must the employer wait for a criminal case to finish?

No. Employment and criminal cases apply different standards of proof and may proceed independently. A criminal complaint does not eliminate the employer’s obligation to provide labor due process.

Can the employee refuse to answer?

The employer may decide the administrative case on the existing record after giving a valid opportunity to respond. Refusal is not automatic proof of fraud, but it may leave important evidence unanswered. Where the response could create criminal exposure, the employee should seek legal advice immediately.

Official sources

This article provides general legal information, not advice for a specific investigation, dismissal, or criminal case. Outcomes depend on the evidence, applicable policies, contracts, CBA provisions, and procedural history. Sources and procedures were checked as of August 4, 2026.