Employee Theft Laws and Penalties in the Philippines

A practitioner-style explainer for employers, HR leaders, and counsel

1) Core criminal framework

A. Theft (Revised Penal Code, Arts. 308–309, as amended)

Definition. Theft is the taking of personal property belonging to another, without the owner’s consent, with intent to gain, and without violence/intimidation (robbery) or force upon things (robbery in an uninhabited place, etc.). In the workplace, the “owner” is typically the employer (or its clients).

Elements (workplace context).

There was a taking (apoderamiento) of a movable,
The item belonged to another (the employer or its customer),
Taking was without consent,
With intent to gain (animus lucrandi), and
Accomplished without violence/intimidation or force upon things.

Penalties. Article 309 uses a value-based scale: the higher the value of the property stolen, the higher the penalty. Republic Act No. 10951 (2017) updated the peso amounts and corresponding penalty ranges. Courts determine: (i) the value of the property, then (ii) apply the penalty bracket prescribed by Art. 309 as amended by RA 10951.

Practice note: Because RA 10951 revised exact peso thresholds, always check the current text when drafting a complaint or advising on exposure.

B. Qualified theft (Art. 310)

When theft becomes “qualified.” Theft is qualified (and punished two degrees higher than the Art. 309 penalty) when committed:

by a domestic servant;
with grave abuse of confidence;
on certain specially protected property (e.g., motor vehicles, mail matter, large cattle, coconuts from a plantation, fish from a fishpond or fishery); or
during calamities and the like.

Employee cases usually hinge on “grave abuse of confidence.” This covers employees who, because of their role (e.g., cashiers, warehouse custodians, tellers), are trusted with proximity or material possession of property and then betray that trust. Courts look for a position of trust plus betrayal closely linked to the taking.

Penalty effect. Whatever penalty Art. 309 yields, increase it by two degrees under Art. 310. This can transform what would be a correctional penalty into an afflictive one, with knock-on effects on prescription and bail.

C. Estafa (swindling; Art. 315 and related provisions)

Some “employee theft” fact patterns are not theft but estafa—particularly where the employee had juridical possession (not mere custody) of the property or money because of their job (e.g., an agent authorized to collect and hold funds on behalf of the company). The line often turns on possession:

Theft: employee had mere material possession (custody) and “carries away” property without consent.
Estafa by abuse of confidence: employee had juridical possession by virtue of their role or agency and misappropriated or converted it.

Practical tip: Audit the source of possession (policy, contract, authority letters, job description) before choosing the charge.

D. Related offenses

Falsification (Arts. 172–174) may attach when employees manipulate receipts, vouchers, time records, or inventory documents.
Anti-Fencing Law (P.D. 1612) applies if someone buys/sells/possesses stolen goods knowing or should have known they were stolen—occasionally relevant to co-conspirators outside the company.
Cybercrime Act (RA 10175) can “tag along” when the taking or conversion is executed or concealed through information systems (e.g., password theft, unauthorized electronic fund transfers, database manipulation).
Special laws may apply for regulated property (e.g., firearms, dangerous drugs, public documents).

2) Values, penalties, and accessory consequences

A. Value determination

The market value at the time and place of the theft usually controls; if uncertain, cost of replacement or other credible valuation may be used.
Documentary proof: invoices, stock cards, bin cards, asset registers, forensic inventory reports, CCTV timestamps tied to SKU/serial numbers.

B. Penalty scaling (Art. 309 as amended by RA 10951)

Penalties escalate by bands tied to the value of the property.
There are also rules for incremental penalties for amounts exceeding certain ceilings.
Qualified theft raises the penalty by two degrees (Art. 310).
Attempted and frustrated stages apply per the Code’s general rules.

Because RA 10951 revised the peso brackets, double-check the current statutory table before filing or advising on likely imprisonment ranges and fines.

C. Aggravating/mitigating circumstances

Generic circumstances (e.g., recidivism, use of motor vehicle, nighttime, craft/fraud/disguise) can increase the penalty within the proper range; plea of guilty, restitution (as a sign of repentance), or lack of intent to gain defenses can mitigate or defeat liability where appropriate.

D. Civil liability

Conviction carries civil liability: restitution of the thing, reparation of damage, and indemnification for consequential losses proved with reasonable certainty. Moral and exemplary damages may be awarded in appropriate civil proceedings.

3) When is it robbery instead of theft?

If the taking is through violence or intimidation against persons, or force upon things (e.g., breaking lockers, forced entry into safes), the crime is robbery (Arts. 293–302). Robbery is charged and penalized under different provisions, often more severe than theft at the same value.

4) Prescription (time limits to prosecute)

Under Art. 90 of the RPC, offenses prescribe based on the maximum penalty they carry (after any qualification). Because theft and qualified theft penalties are value-dependent, prescription can range from years (correctional/afflictive) to shorter periods for lower-value cases. Counting rules are in Arts. 90–91; filing a complaint with the prosecutor typically interrupts prescription.

5) Labor law consequences (discipline and dismissal)

A. Just causes (Labor Code, as renumbered)

Employee theft or dishonesty is commonly a just cause under:

Serious misconduct;
Fraud or willful breach of trust; and/or
Commission of a crime or offense against the employer or his family.

Employees in positions of trust and confidence (e.g., cashiers, storekeepers, supervisors handling assets) are especially vulnerable to loss of trust dismissals when substantial evidence supports the breach.

B. Due process (“twin-notice” rule)

First notice: specific acts/omissions charged, rule/policy violated, and reasonable time to explain.
Opportunity to be heard: written explanation and/or conference/hearing where the employee can present evidence.
Second notice: decision stating facts, rule violations, and penalty.

C. Preventive suspension

Permissible when the employee’s continued presence poses a serious and imminent threat to company property or co-workers. As a rule of thumb, up to 30 days; beyond that requires pay or completion of investigation sooner.

D. Separation pay

As a rule, none is due for dismissals based on just causes. Courts sometimes award financial assistance on equitable grounds, but this is exceptional and fact-specific.

E. Evidence standard (administrative vs. criminal)

Administrative (for dismissal): substantial evidence (that which a reasonable mind might accept as adequate).
Criminal (for conviction): proof beyond reasonable doubt.

These different standards mean an employee may be validly dismissed even if the criminal case is acquitted (e.g., acquittal on reasonable doubt), and vice versa.

6) Investigations: employer best practices

Immediate containment. Secure access controls, suspend system credentials, and consider preventive suspension if justified.
Preserve evidence.
- CCTV: export clips, hash files, and maintain chain of custody.
- Digital logs: POS trails, audit logs, email exports, access-control records.
- Physical: inventory count sheets, broken seals, tamper-evident photos.
Document authority and policies. Job descriptions, custodianship receipts, asset assignment forms, and policies on property handling are often decisive on possession (theft vs. estafa).
Conduct interviews with written advisories; obtain sworn statements.
Forensic inventory & valuation. Tie SKUs/serial numbers to purchase documents and stock cards.
Data privacy compliance. Processing personal data for legitimate interests (security, fraud prevention) is generally permitted by the Data Privacy Act, but notify employees via policies and signages; limit collection to what is necessary; secure the data.
Coordinate with counsel for inquest (if arrestable) or prosecutor filing (complaint-affidavit with annexes).
Parallel tracks. You may proceed with administrative action independent of the criminal process, applying the proper standards.

7) Filing the criminal case

In flagrante delicto: Security can execute a citizen’s arrest for an offense actually being committed, then turn over to police for inquest.
Otherwise: Prepare a complaint-affidavit with annexes (inventory, CCTV, logs, authority documents, valuation, demand letters).
Venue: where the offense occurred (e.g., store branch city).
Parties: the People (through the prosecutor) vs. the employee; the employer is the complainant and may pursue civil liability.
Restitution/settlement: Voluntary return or compromise does not automatically extinguish criminal liability for theft/estafa, though it may be mitigating and can settle the civil aspect if properly documented.

8) Common defenses (and how they are addressed)

No intent to gain: e.g., claim of temporary borrowing. Rebut with circumstantial evidence (concealment, disposal, flight, false entries).
Ownership/authority: employee asserts consent or right. Rebut with asset ownership documents and lack of authorization.
Chain of custody gaps: fix through timely preservation and logbooks.
Improper dismissal (labor): ensure twin-notice and substantial evidence; match penalty to policy and precedent.

9) Policy architecture to deter and manage employee theft

Clear handbook provisions on property, custody, conflicts of interest, and sanctions, acknowledged by employees.
Segregation of duties and approval matrices for asset movement and write-offs.
POS/ERP controls: unique credentials, least-privilege access, immutable audit logs.
Inventory discipline: cycle counts, surprise audits, seal controls for high-value items.
CCTV and EAS/RFID where proportionate; signages for data privacy transparency.
Incident response playbook: RACI chart (HR–Legal–Security–IT–Finance), evidence checklist, counsel escalation tree.
Third-party risks: vendor and contractor clauses on employee dishonesty and indemnity.
Insurance: consider Employee Dishonesty/Fidelity coverage; know notice and proof-of-loss requirements.

10) Quick comparison: theft vs. qualified theft vs. estafa

Feature	Theft	Qualified Theft	Estafa (by abuse of confidence)
Possession held by offender	Mere custody	Mere custody (but w/ qualifying circumstance)	Juridical possession (by role/agency)
Key qualifier	None	Grave abuse of confidence (typical for employees); or special property/calamity	Misappropriation/Conversion of property received in trust
Penalty baseline	Art. 309 (value-based)	Art. 310: +2 degrees over Art. 309	Art. 315 (value-based; amended by RA 10951)
Typical workplace example	Stockroom staff pockets item	Cashier diverts cash using entrusted access; warehouse custodian siphons inventory	Collection agent keeps payments turned over to him to hold for company

11) Frequently asked practical questions

Q: Can we dismiss first and file criminal charges later? Yes. Administrative and criminal proceedings are independent; use the substantial evidence standard for dismissal and the beyond reasonable doubt standard for the criminal case.

Q: Do we need the employee’s written admission? No. Theft may be proven by circumstantial evidence (CCTV + inventory variance + access logs + possession of items).

Q: Will paying back the loss erase the crime? No. Restitution may mitigate penalty or settle the civil aspect but does not automatically erase criminal liability.

Q: How do we compute exposure? Identify the value of the property (or shortage) and apply the current RA 10951 thresholds under Art. 309 (or Art. 315 for estafa), then factor in qualified theft (two degrees higher) where applicable.

Q: What if the item belongs to a client, not to us? You can be the complainant as the injured party with custody/possession at the time; ownership proof from the client helps and the employee’s lack of authority remains central.

12) Action checklist (employer)

Freeze access / consider preventive suspension.
Preserve CCTV, logs, and documents; start a chain-of-custody record.
Conduct forensic inventory; fix the value.
Issue first notice; obtain written explanation; hold hearing.
Issue decision (or closure memo); implement penalty.
Prepare complaint-affidavit for theft/qualified theft or estafa (after assessing possession), with annexes.
Consider civil claim and/or insurance notice.
Review and harden controls to prevent recurrence.

Final caveat

This article summarizes the general doctrine and procedure on employee theft in the Philippines. Exact penalty brackets and some thresholds were recalibrated by RA 10951 (2017), and special laws may apply based on the facts. For charging decisions, plea strategies, or precise penalty computations, examine the current text of the provisions and recent jurisprudence for your scenario.