Quick answer

An employer may investigate suspected employee fraud or falsified records, but dismissal is valid only if both requirements are met:

There is a legally sufficient just cause supported by substantial evidence—not merely suspicion, rumor, an unexplained discrepancy, or an accusation; and
The employee receives procedural due process—a detailed first written notice, at least five calendar days from receipt to explain, a meaningful opportunity to answer and present evidence, and a written notice of the final decision.

Fraud is a just cause under Article 297(c) of the Labor Code when the proven conduct is intentional, work-related, committed against the employer or its representative, and involves a breach of a duty, trust, or confidence. Falsification may also amount to serious misconduct or willful breach of trust, depending on the employee’s duties, intent, company rules, and the actual record involved.

A clerical error, incomplete entry, disputed instruction, system defect, or negligent mistake is not automatically fraud. The employer bears the burden of proving a lawful dismissal by substantial evidence.

These rules principally cover private-sector employment. Government personnel are generally governed by civil-service and administrative disciplinary rules. A collective bargaining agreement, employment contract, or company policy may provide additional protections that must also be followed.

The two parts of a valid dismissal

Substantive due process: there must be just cause

Article 297 of the Labor Code recognizes, among other just causes:

Serious misconduct connected with the employee’s work;
Fraud or willful breach of the trust reposed in the employee;
Commission of a crime or offense against the employer, certain members of the employer’s family, or an authorized representative; and
Causes analogous to those expressly listed.

For fraud, the Supreme Court has identified these essential considerations:

There is an act, omission, or concealment;
It breaches a legal duty, trust, or confidence justly reposed in the employee;
It is committed against the employer or the employer’s representative; and
It is connected with the employee’s work.

Fraud and willful breach of trust are related but distinct grounds. If the employer relies specifically on loss of trust and confidence, it must also establish that the employee occupied a position of trust and that the loss of trust arose from clearly established facts. Positions of trust commonly include managerial employees and rank-and-file employees who regularly handle significant money, property, records, access credentials, or other sensitive matters.

Possible examples—subject always to proof and context—include deliberately altering sales, payroll, inventory, attendance, expense, medical, production, collection, or reimbursement records; creating fictitious transactions; using another person’s credentials to make unauthorized entries; knowingly submitting forged supporting documents; or concealing a shortage through false entries.

The employer should still ask:

Was the entry deliberately false, or could it be an honest or system-generated error?
Did the employee make, authorize, direct, benefit from, or knowingly conceal it?
Was the rule or procedure known and consistently enforced?
Is the conduct sufficiently serious and work-related to justify dismissal?
Does the company’s disciplinary schedule require a lesser penalty?
Have comparable cases been treated consistently?

Dismissal is the severest workplace penalty. The offense, intent, position, damage or risk, surrounding circumstances, prior record, and the employer’s own rules should be evaluated together. A conclusion cannot rest solely on the weakness of the employee’s explanation; the employer must prove its case through its own evidence.

Procedural due process: the employee must be heard before the decision

Article 292(b) of the Labor Code and Section 5.1 of DOLE Department Order No. 147-15 require the following process for dismissal based on just cause.

Stage	Minimum requirement
First written notice	Identify the specific Article 297 ground and company rule, if any; narrate the material facts in detail; and direct the employee to explain in writing
Time to answer	At least five calendar days from receipt of the notice
Opportunity to be heard	A meaningful chance to answer, submit evidence, explain discrepancies, and obtain assistance from a representative if desired
Hearing or conference	Mandatory when requested by the employee in writing, when substantial evidentiary disputes exist, when company rule or practice requires one, or when similar circumstances justify it
Second written notice	State that all circumstances and the employee’s defense were considered and explain the established ground and final decision

The five-day period runs from the employee’s receipt, not merely from the date printed on the notice. The notice should ordinarily identify the questioned transactions, documents, dates, amounts, accounts, acts, and violated rules. A vague accusation such as “dishonesty,” “fraudulent activity,” or “falsification of company records” is not enough for an intelligent defense.

A trial-type hearing is not required in every case. A detailed written explanation can constitute an ample opportunity to be heard when there is no material factual dispute and no applicable rule requires a conference. But where authenticity, authorization, identity, intent, system access, or witness credibility is genuinely disputed, a fair conference is normally necessary.

A fair investigation process

1. Secure the records without deciding guilt

Preserve relevant originals and reliable copies before routine deletion, overwriting, or document disposal occurs. Depending on the allegation, this may include:

Original paper records and questioned documents;
Audit trails, version histories, timestamps, and access logs;
Accounting ledgers, vouchers, invoices, receipts, and bank records;
Attendance, biometric, payroll, inventory, production, or point-of-sale data;
Company emails, approved workplace messages, and workflow records;
CCTV footage collected and retained lawfully;
System configuration, user-role, and credential-assignment records;
Written policies, training records, and proof that the employee knew the procedure;
Witness statements based on personal knowledge; and
Records showing who had custody, access, editing authority, or approval power.

Document when and by whom each item was obtained, copied, transferred, reviewed, and stored. Preserve metadata and read-only exports where possible. Do not edit a disputed file and then treat the edited version as the original.

An unusual login or entry does not, by itself, prove who operated the device. Shared accounts, delegated work, remote access, compromised credentials, incorrect system clocks, automation, and later edits must be checked.

2. Define the allegation precisely

Separate each suspected incident by transaction, date, record, and alleged act. Identify whether the issue is:

Deliberate creation or alteration of a false record;
Use or submission of a record known to be false;
Concealment of a transaction or shortage;
Unauthorized approval or override;
Negligent recordkeeping;
Failure to follow a procedure; or
A system, training, supervision, or control failure.

This distinction matters. Fraud ordinarily requires intentional deception; negligence and noncompliance have different legal elements.

3. Use a capable and conflict-conscious investigator

The investigator should understand the records and should not be a principal accuser, beneficiary, or person whose own conduct is under scrutiny. Where necessary, involve internal audit, information security, data-protection personnel, or an independent specialist.

The law does not require a private employer to create a court-like independent tribunal. Still, separating fact-finding from final approval reduces bias and makes the decision easier to defend.

4. Apply only necessary interim controls

Before considering preventive suspension, use less intrusive controls where adequate—for example:

Temporarily changing system permissions;
Requiring dual approval;
Reassigning cash, inventory, or record custody;
Preserving accounts without deleting their contents;
Restricting access to the specific affected system; or
Moving the employee temporarily to equivalent non-sensitive duties.

Interim controls must not amount to punishment, demotion, humiliation, or a disguised dismissal.

5. Issue a detailed notice to explain

The first notice should contain enough information for a meaningful response, including:

The specific acts or omissions charged;
Relevant dates, records, transactions, and amounts;
The employee’s alleged participation;
The applicable Labor Code ground;
The specific company rule, contractual obligation, or procedure involved;
The deadline, giving at least five calendar days from receipt; and
Where and how the employee may submit an explanation and supporting evidence.

If several employees are implicated, issue individualized notices. Do not assume that everyone with access participated in the same way.

6. Consider the employee’s complete defense

Assess explanations against the records rather than dismissing them as “self-serving.” Verify claims about:

Instructions from supervisors;
Shared passwords or terminals;
Approved corrections or backdated entries;
Delegated authority;
System errors or synchronization problems;
Missing source documents;
Established workplace practices;
Lack of training or unclear policies;
Identity or signature disputes;
Retaliatory or biased witnesses; and
Other people with access or motive.

If new material allegations arise, give the employee a fair opportunity to address them. A dismissal decision should not rely on an uncharged incident that the employee never had a chance to explain.

7. Hold a conference when required or useful

Give reasonable notice of the conference and identify its purpose. Permit the employee’s chosen representative where requested. Keep an accurate record of attendance, questions, answers, documents presented, requests made, and agreed follow-up actions.

The conference should clarify disputed facts, not pressure the employee into resigning, signing a confession, waiving claims, or immediately paying an alleged loss.

8. Decide from the complete record

The decision-maker should prepare a finding for each charge:

What fact was established?
What evidence supports it?
What part of the employee’s explanation was accepted or rejected, and why?
Was intent established, or only error or negligence?
What policy and Labor Code ground applies?
Is dismissal proportionate and consistent with company practice?

The governing standard in a labor case is substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support the conclusion. It is lower than proof beyond reasonable doubt, but it is more than accusation, speculation, or bare suspicion.

9. Serve a reasoned final notice

If dismissal is justified, the second notice should identify the established charge, state that the explanation and relevant circumstances were considered, and communicate the effective date and final decision. Serve notices personally or at the employee’s last known address as required by the rules. Electronic delivery may supplement, but should not casually replace, a reliable method prescribed by law or company policy.

If the evidence does not support the charge, close the case in writing, restore unjustifiably restricted work access or duties, and correct affected employment records.

Preventive suspension is limited

Preventive suspension is not an automatic response to a fraud allegation and is not itself a penalty. It may be imposed only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers.

Access to funds, financial systems, original records, inventory, or evidence that could be altered may be relevant, but the employer should document the actual threat and why narrower controls are inadequate.

A preventive suspension may generally last no more than 30 days. After that, the employer must:

Reinstate the employee to the former or a substantially equivalent position; or
Extend the suspension while paying the wages and other benefits due during the extension.

An initially justified suspension can become constructive dismissal if it continues beyond the lawful period without actual or payroll reinstatement. If there was no sufficient basis for preventive suspension, the employee may be entitled to pay for the suspension period.

Track the start date carefully and conclude the investigation promptly.

Privacy and confidentiality during evidence collection

An investigation is not a blank check to search every personal account, device, conversation, or file.

The Data Privacy Act applies when an employer collects, examines, stores, shares, or otherwise processes personal data. Processing must have a lawful basis and comply with transparency, legitimate purpose, proportionality, security, and accountability.

Legitimate interest may support necessary processing of ordinary personal information for fraud prevention or investigation, subject to the required balancing assessment. It is not, by itself, a lawful basis for processing sensitive personal information; another basis under Section 13 of the Data Privacy Act may be necessary.

Practical safeguards include:

Limit collection to records relevant to the defined allegation;
Observe workplace privacy notices, acceptable-use rules, and monitoring policies;
Avoid accessing private personal accounts without lawful authority;
Restrict the case file to personnel with a genuine need to know;
Keep an access log and use secure storage;
Redact unrelated personal information;
Avoid public accusations or unnecessary disclosure to co-workers;
Retain evidence only as long as required for the investigation, legal claims, or applicable retention rules; and
Consult the data protection officer where monitoring, CCTV, biometrics, health records, privileged communications, or sensitive personal information is involved.

Criminal complaints are separate

Falsified records may potentially involve offenses under the Revised Penal Code or other laws, but the proper charge depends on the document, conduct, intent, damage, and surrounding facts. An employer should obtain legal advice before making a police or prosecutor referral.

The employer does not normally have to wait for a criminal conviction before deciding an employment case. Labor cases require substantial evidence, while criminal conviction requires proof beyond reasonable doubt. Conversely, filing a criminal complaint does not automatically prove a valid dismissal. The employer must still establish just cause and observe workplace due process.

Evidence should not be fabricated, altered, concealed, or presented misleadingly to law enforcement. Avoid forcing a confession or using threats of arrest to obtain a resignation, reimbursement agreement, or quitclaim.

Possible outcomes and legal consequences

If just cause and procedure are both established

The dismissal may be valid. Statutory separation pay is generally not due for a just-cause dismissal unless a contract, collective bargaining agreement, company policy, or applicable ruling provides otherwise. Earned wages and other components of final pay remain payable.

Under DOLE guidance, final pay should generally be released within 30 days from separation unless a more favorable company policy or agreement applies. A certificate of employment must be issued within three days from the employee’s request.

If just cause exists but procedure was defective

The dismissal may remain valid, but the employer may be ordered to pay nominal damages. Under the Supreme Court’s Agabon line of cases, nominal damages in a just-cause dismissal have generally been fixed at ₱30,000, subject to the controlling ruling on the particular case.

If the employer fails to prove just cause

The dismissal is illegal even if notices and meetings were provided. Available relief may include reinstatement without loss of seniority rights and full backwages, or separation pay in lieu of reinstatement when reinstatement is no longer feasible, together with other relief warranted by the facts.

Procedural paperwork cannot cure the absence of substantial evidence.

If you are the employee under investigation

Act promptly and keep communications professional.

Note the exact date and time you received every notice. Signing an acknowledgment may be limited to receipt; read any additional wording before signing.
Ask in writing for sufficiently specific charges, relevant transaction details, applicable rules, and reasonable access to records needed for your defense.
Calendar the deadline. If more time is genuinely necessary, request an extension before the deadline and explain why.
Respond point by point. Distinguish what you admit, deny, cannot verify, or need records to answer.
Attach supporting documents and identify witnesses with personal knowledge.
Request a conference in writing if material facts, authenticity, intent, authorization, or witness accounts are disputed.
Ask to be assisted by a union officer, lawyer, or other representative if desired and permitted by the applicable process.
Preserve notices, envelopes, courier records, emails, messages, policies, payslips, access records, schedules, and your submitted explanation.
Do not delete files, alter records, coach witnesses, or use access you are no longer authorized to use.
If preventively suspended, record the first day, terms, pay status, and any return-to-work communication.
Do not sign a resignation, confession, repayment agreement, or quitclaim you do not understand or do not voluntarily accept.

A written explanation should be truthful. Where criminal exposure is reasonably possible, obtain independent legal advice before making detailed admissions.

Common mistakes

Mistakes by employers

Treating a shortage or discrepancy as automatic proof of theft or fraud;
Giving fewer than five calendar days from actual receipt to answer;
Using generic notices without transactions, dates, acts, or violated rules;
Deciding the outcome before receiving the employee’s defense;
Relying on anonymous claims without corroboration;
Ignoring shared access, system defects, or supervisory instructions;
Adding new grounds only in the final notice;
Refusing a written request for a hearing despite a substantial factual dispute;
Keeping the employee indefinitely suspended without pay;
Disregarding a CBA, handbook, progressive-discipline rule, or established practice;
Forcing a resignation or repayment as the price of avoiding criminal charges;
Deducting a disputed loss from wages or final pay without a lawful basis; or
Publicly naming the employee or circulating investigative material unnecessarily.

Mistakes by employees

Ignoring the notice because the accusation seems unfair;
Submitting only a general denial;
Missing the response deadline without requesting an extension;
Deleting messages or changing records after learning of the investigation;
Assuming acquittal in a criminal case automatically defeats the labor case;
Refusing all conferences without documenting the reason;
Signing a resignation or quitclaim under pressure without keeping a copy; or
Failing to document the dates and terms of preventive suspension.

When legal help is urgent

Seek advice promptly when:

The response deadline is near and the notice alleges theft, estafa, falsification, or another possible crime;
Police, prosecutors, or regulatory authorities are already involved;
The employer seeks access to a personal device or account;
Privileged, medical, biometric, banking, or other sensitive data is involved;
The employee is being pressured to resign, confess, repay money, or sign a quitclaim;
Preventive suspension is approaching or has exceeded 30 days without proper reinstatement or paid extension;
Evidence may be deleted, overwritten, or destroyed;
Retaliation, union activity, discrimination, or whistleblowing may be involved; or
A termination notice has already been served.

An aggrieved employee or employer may file a Request for Assistance under the Single Entry Approach. Current SEnA rules generally provide a 30-day mandatory conciliation-mediation process. Requests may be filed through a DOLE, NLRC, or NCMB assistance desk, or through the official DOLE Assistance for Request Management System.

If conciliation does not resolve an illegal-dismissal dispute, the proper complaint is generally filed before an NLRC Labor Arbiter. Illegal-dismissal actions generally prescribe after four years from accrual, while many employment money claims have a three-year period. Do not wait for the deadline: delay can cause evidence, witnesses, and remedies to become harder to secure.

Frequently asked questions

Can an employee be dismissed immediately after fraud is discovered?

Ordinarily, no. Even strong evidence does not dispense with the first notice, reasonable time to explain, meaningful opportunity to be heard, and final written notice. Temporary access controls or a properly justified preventive suspension may protect property while the process is completed.

Is the employee entitled to a lawyer?

A lawyer is not mandatory for an internal investigation. The employee may, however, seek assistance from a representative if desired. The applicable CBA or company rules may define how representatives participate.

Must the employer give the employee every document in the investigation file?

There is no general requirement for full court-style discovery in an internal employment investigation. The employee must nevertheless receive sufficiently detailed allegations and a meaningful chance to answer the material evidence. Withholding the transaction details or records necessary to understand the charge may make the opportunity to respond illusory.

What if the employee refuses to receive or answer the notice?

Document the attempted personal service and use the employee’s last known address as allowed by the rules. Refusal or silence does not automatically prove the charge, but the employer may decide from the available evidence after providing a genuine opportunity to respond.

Can company email, CCTV, or computer logs be used?

Potentially, yes, when collected and used lawfully, for a defined and legitimate purpose, and consistently with the Data Privacy Act, workplace notices, company policies, and appropriate security measures. Access must be necessary and proportionate; ownership of the equipment does not eliminate all employee privacy rights.

Does reimbursement erase the fraud?

Not necessarily. Repayment may be relevant to intent, mitigation, or loss, but it does not automatically erase proven dishonesty. Likewise, an unpaid shortage does not by itself prove that a particular employee committed fraud.

Can a minor falsification justify dismissal?

It depends on intent, work connection, the employee’s duties, the importance of the record, company rules, prior treatment of comparable offenses, and whether the conduct destroyed a trust essential to the job. The word “falsification” alone does not make dismissal proportionate.

May the employer announce the investigation result to the workforce?

Disclosure should be limited to what is necessary for legitimate business, legal, regulatory, or safety purposes. Broadly identifying or shaming the employee may create privacy, defamation, labor-relations, and workplace-safety risks.

Official sources

This article provides general Philippine legal information, not legal advice for a particular investigation or dispute. Outcomes depend on the actual documents, employment status, workplace rules, CBA provisions, evidence, and procedural history. Sources and procedures were checked as of 23 July 2026.