Employee Theft Allegations in the Philippines: Criminal Liability, Settlement Paths, and Due Process

Last updated: October 1, 2025 (Philippine legal context). This article provides general information and is not a substitute for legal advice.

1) What counts as “employee theft”?

In Philippine law, “employee theft” is not a standalone statutory phrase. Alleged acts by an employee can fall under several offenses in the Revised Penal Code (RPC) and special laws:

Theft (RPC, Arts. 308–311) – Taking another’s personal property, without consent, with intent to gain.
- Qualified theft applies when committed with abuse of confidence (e.g., by a cashier, warehouseman, or anyone given custody), or in other qualifying contexts. Penalties are higher than simple theft.
Estafa or swindling (RPC, Art. 315) – Defrauding another through abuse of confidence (e.g., misappropriation of company funds entrusted for deposit, liquidation, or safekeeping; falsified liquidations).
Robbery (RPC, Arts. 294–302) – Taking with violence or intimidation, or by force upon things.
Falsification (RPC, Arts. 171–172) – When the act involves tampering with vouchers, receipts, or company records to conceal a taking.
Special laws (as applicable) – e.g., cyber-related taking or data exfiltration (unauthorized access, data interference), access-device fraud, intellectual-property violations. Corporate or officer liability may be imposed by some special statutes.

Money vs. data/information: “Property” is traditionally corporeal chattels and money. Where the “taking” concerns confidential business data or digital assets, prosecutors often test the facts against estafa, qualified theft (when tied to physical media/credentials), or special cyber statutes.

2) Criminal exposure and penalties (high level)

Offense and penalty depend on the facts: the nature of the act (taking, misappropriation, deceit), the value involved, the relationship of trust, and the presence of aggravating or mitigating circumstances.
Value matters: Penalties for theft/estafa are graduated by the amount involved (as amended by later laws adjusting monetary thresholds). Prosecutors will document valuation (audit, receipts, inventory reports, CCTV, admissions).
Qualified theft: When the offender abuses confidence or is a domestic servant/employee with custodial access, the penalty is generally higher than simple theft.
Complex crimes: A single act can implicate multiple provisions (e.g., estafa + falsification). Charging is a prosecutorial call; courts prevent double punishment for the same act but permit alternative or complex charging.

3) Criminal procedure playbook: from allegation to judgment

A. Apprehension and evidence preservation

In flagrante delicto arrest: Security may effect a citizen’s arrest if the act is ongoing or has just been committed and the employee is positively identified. Otherwise, arrest generally needs a warrant.
Searches at work: Employers may enforce reasonable bag/locker checks under company policy and with notice. Intrusive or coercive searches risk exclusion of evidence and civil/criminal exposure.
Evidence to preserve: CCTV footage, access logs, POS reports, inventory sheets, custodian receipts, emails/chats, device audit trails, written admissions, and chain-of-custody notes. Avoid altering originals; use certified copies where possible.

B. Filing a criminal complaint

Venue: City/Provincial Prosecutor’s Office where the crime occurred.
Complaint package: Sworn complaint, affidavits of witnesses, valuation/audit documents, and supporting media.
Inquest vs. regular preliminary investigation:
- Inquest (for warrantless arrests): swift review; the respondent may request a full preliminary investigation.
- Preliminary investigation: Respondent receives a subpoena, may file a counter-affidavit with evidence, and both sides can submit replies/rejoinders.

C. Determination of probable cause

Standard: “Probable cause” (not proof beyond reasonable doubt). If found, an Information is filed in court; a judge may issue a warrant of arrest.
Bail: Most property crimes are bailable; the amount depends on the charge and value involved.

D. Trial

Burden: Prosecution must establish elements of the offense beyond reasonable doubt.
Defenses: Lack of intent to gain, ownership/claim of right, consent/authority, lack of taking or misappropriation, defective identification, inadmissible evidence, accounting/valuation disputes, good-faith discharge of duties.

E. Civil liability in the criminal case

Civil liability (restitution, reparation, damages) is impliedly instituted with the criminal action unless the company expressly waives or reserves a separate civil case.

4) Labor dimension: dismissals, due process, and standards of proof

Criminal exposure is separate from employment discipline. An employer may discipline or dismiss even if a criminal case is not filed or results in acquittal, provided the employer proves a just cause under the Labor Code and observes due process.

A. Possible just causes (Labor Code, as amended)

Serious misconduct
Willful breach of trust / Loss of trust and confidence (LOTC)
Fraud or willful breach of employer’s rules
Commission of a crime or offense against the employer, his family, or representatives

LOTC nuances: • For managerial employees, it suffices to show a reasonable basis for loss of trust. • For rank-and-file employees in fiduciary/handling positions (cashiers, storekeepers), proof of willful breach related to duties is required. • Standard of proof is substantial evidence (relevant evidence that a reasonable mind might accept) — lower than criminal proof.

B. The twin-notice and hearing rule (administrative due process)

Notice to Explain (NTE) – Detailed facts, policy violated, and reasonable time to answer (commonly 5 calendar days).
Opportunity to be heard – Written explanation and/or conference/hearing where the employee may present evidence and counsel/representative.
Notice of Decision – Clear findings of fact, rule violated, and penalty imposed.

C. Preventive suspension

Allowed to prevent interference with investigation or where continued presence poses a serious and imminent threat to property or co-workers.
Capped at 30 days (with pay if extended), with the employer expected to conclude the investigation promptly.

D. Documentation essentials

Written policies, receipts of policy dissemination, NTE, minutes of hearing, audit findings, signed custodial logs, decision memo.
In case of dismissal, issue a Certificate of Final Pay and settle statutory benefits; handle COE (Certificate of Employment) neutrally.

5) Settlement pathways: what can and cannot be compromised

A. Criminal case

Crimes are offenses against the State. Restitution, an affidavit of desistance, or a private settlement does not automatically extinguish criminal liability.
Prosecutors and courts may consider restitution/desistance, potentially leading to dismissal for lack of interest or insufficient evidence, but they are not bound to do so.
Plea bargaining is possible (e.g., to a lesser offense or lower value bracket) subject to prosecutorial and judicial approval.
Civil liability can be settled (restitution, compromise on damages) independently of criminal action.

B. Labor/administrative dispute

SEnA (Single-Entry Approach) and NLRC/NCMB conciliation-mediation allow pragmatic settlements (e.g., resignation with financial consideration, backwages/ separation pay compromises).
Quitclaims are valid if voluntary, with reasonable consideration, and free from coercion; they do not bar suits for void waivers or undisclosed claims.

6) Rights of the accused employee

Miranda rights upon custodial investigation; right to counsel and to remain silent.
Right against unreasonable searches and seizures; consent must be clear, voluntary, and informed.
Right to due process in administrative proceedings (NTE–hearing–decision).
Right to bail (for bailable offenses).
Right to speedy disposition — undue delays can be challenged.

7) Employer playbook: practical steps that hold up

A. Before it happens: prevention

Clear Code of Conduct: asset handling, cash control, discounts/benefits, conflict-of-interest, gift policy, bring-home rules.
Segregation of duties: no single person controls ordering, receiving, recording, and cash.
Access controls: POS credentials, logs, inventory keys, system role-based access.
CCTV and audit trails with retention policies; signages satisfy notice requirements.
Whistleblower channels and protection; annual certifications for custodians.
Training on documentation, incident reporting, and respectful interviews.

B. When an incident surfaces

Stabilize: secure scene, isolate potentially involved systems, preserve logs/CCTV, document times and persons present.
Triage evidence: collect receipts, stock counts, cash counts; freeze user credentials; photograph items in situ; start a simple chain-of-custody log.
Administrative track: issue NTE, consider preventive suspension, schedule hearing, and finalize decision memo.
Criminal track (if warranted): prepare sworn statements, valuation, and media (CCTV) in standard formats (USB/DVD with hash, if possible).
Communications: limit to “need-to-know”; avoid public shaming, defamatory announcements, or mass emails naming suspects.

8) Employee playbook: if you’re accused

Ask for the NTE and evidence; request copies of CCTV snapshots, reports, or an evidence list.
Submit a written explanation with documents (e.g., receipts, approvals) and witness names.
Attend the hearing with a representative; put objections on record (searches, handling of evidence).
Preserve your own evidence: work chats/emails, schedule records, CCTV in adjacent areas, timecards.
Consider counter-charges only after counsel review (e.g., unlawful detention, grave coercion, defamation), to avoid escalation without basis.

9) Proof issues that frequently decide cases

Intent to gain (animus lucrandi) may be inferred from circumstances (concealment, false entries, flight). Employees can rebut with claim of right, authority, or operational error.
Abuse of confidence hinges on entrustment (e.g., keys, vault access, cash handling)—documented delegation helps.
Valuation must be credible (purchase orders, inventory sheets, audited counts).
Chain of custody for seized items bolsters authenticity; sloppy handling weakens prosecution.
Policy dissemination matters: employers should prove the employee knew the rule.

10) Timelines, prescription, and jurisdiction (quick guide)

Barangay conciliation: Not generally required for employer–employee disputes and for many theft cases (because of penalty thresholds or excluded relationships).
Prescription: Crimes and labor claims have different limitation periods; exact periods depend on the offense charged or claim type. Don’t delay action—preserve evidence and consult counsel promptly.
Venue: Criminal cases where the act occurred; labor cases at DOLE/NLRC regional venues where the complainant or respondent resides or works.

11) Civil strategies alongside (or instead of) criminal action

Independent civil action for damages (e.g., Article 19/20/21 Civil Code) if you reserve it or the circumstances fit (torts, unfair competition).
Replevin/attachment for recoverable chattels or to secure assets (subject to bonds and strict rules).
Restitution agreements (confession of judgment, post-dated checks with caution) with confidentiality, non-disparagement, and cooperation clauses. Always vet for enforceability and statutory compliance.

12) Data privacy and HR compliance

CCTV/monitoring should have privacy notices; use footage only for legitimate purposes (security, investigation).
Limit access to investigation files to HR/legal; log viewers and sharing.
Retention: Keep for only as long as necessary for the investigation, litigation, and compliance.
Background checks must be proportionate and consented; avoid discriminatory screening.

13) Internal resolution models (illustrative)

Model A – Administrative close with written reprimand or LOTC dismissal Used where the evidence meets substantial evidence but the employer opts not to file a criminal case. Decision memo states facts, rule breached, penalty, and turnover to HR records.

Model B – Restitution + resignation (or mutual separation) Settlement at DOLE SEnA or privately: quantified loss, payment schedules, standard quitclaim language, data return and non-use undertakings.

Model C – Parallel tracks Administrative dismissal for LOTC plus criminal complaint with reservation/waiver of civil action as strategy dictates.

14) Common pitfalls to avoid

Skipping the second notice after the hearing.
Preventive suspension beyond 30 days without pay or without concluding the investigation.
Humiliating “parades,” mass emails, or social media posts that risk libel and data privacy violations.
Relying solely on an uncorroborated confession; corroborate with documents/logs.
Confusing “estafa” vs “theft”: misappropriation of entrusted funds often points to estafa; physical taking without entrustment often points to theft.
Assuming a quitclaim kills a criminal case—it doesn’t.
Undervaluing valuation: sloppy accounting can sink a case.

15) Templates and checklists (concise)

A. Notice to Explain (NTE) – key elements

Specific acts (who/what/when/where/how), rule violated, and requested written explanation within a definite period.
Advise of the right to a hearing and to bring evidence/representative.
Attach or enumerate evidence (e.g., POS report no. ___; CCTV time stamps; audit variance sheet).

B. Administrative hearing minutes – must note

Date/time, attendees, rights explained, allegations restated, employee’s defenses, exhibits discussed, and any follow-up submissions allowed.

C. Decision notice – must state

Findings of fact tied to evidence, rule violated, legal basis (e.g., serious misconduct/LOTC), and penalty with effectivity date; remedies (e.g., return of property), and clearance/COE handling.

D. Evidence preservation checklist

Export CCTV clips with time stamps; hash or checksum if feasible.
Print and e-sign witness affidavits.
Secure POS/back-office logs and access trails.
Photographs of items and seizure receipts signed by two witnesses.
Seal and label physical evidence; maintain a simple chain-of-custody log.

16) FAQs

Q: Can a company dismiss an employee even if the criminal case is dismissed? A: Yes, if the administrative dismissal stands on substantial evidence and proper due process, independent of criminal acquittal.

Q: Is repayment enough to avoid jail? A: No. Restitution may mitigate or influence prosecutorial discretion or plea bargaining, but it doesn’t automatically extinguish criminal liability.

Q: Can HR demand to search a phone? A: Only with clear, voluntary consent or a lawful order. Better practice is to rely on company-owned devices with signed acceptable-use policies and technical retrieval of company data.

Q: Are polygraph results admissible? A: Generally not determinative. Focus on documentary and testimonial evidence.

17) Executive takeaways

Treat workplace theft allegations as two tracks: criminal (State vs. person) and administrative (employer vs. employee).
Proof thresholds differ: “beyond reasonable doubt” in criminal; “substantial evidence” in HR proceedings.
Process is protection: twin-notice + hearing + reasoned decision; preventive suspension used sparingly and properly.
Settlements can resolve civil exposure and employment issues, but do not automatically end criminal liability.
Discreet, rights-respecting investigations produce better outcomes and reduce counter-claims.

Final note

Specific charges, penalty brackets, and defenses are fact-sensitive. Consult a Philippine lawyer for tailored advice—especially before filing a criminal complaint, accepting a settlement, or issuing a dismissal decision.