A Legal Article in the Philippine Context

I. Introduction

Employee theft is one of the most serious workplace offenses in the Philippines. It may involve cash, inventory, company property, documents, trade secrets, digital assets, confidential information, customer payments, equipment, or funds entrusted to an employee. When theft is discovered, the employee may attempt to resign, negotiate repayment, or argue that the matter is merely an internal employment issue. Employers, on the other hand, may consider dismissal, civil recovery, criminal prosecution, or all of these remedies at once.

In Philippine law, employee theft can create three separate kinds of liability:

Administrative or employment liability, such as dismissal for just cause;
Civil liability, such as restitution, damages, or return of property; and
Criminal liability, such as theft, qualified theft, estafa, falsification, cybercrime-related offenses, or other crimes depending on the facts.

Resignation does not automatically erase liability. Payment does not automatically erase criminal liability. Settlement does not always prevent prosecution. And dismissal is not the same as criminal conviction. Each legal consequence has its own requirements, procedures, and standards of proof.

II. What Is Employee Theft?

Employee theft refers broadly to the unlawful taking, misappropriation, conversion, concealment, or unauthorized use of property, money, documents, data, or assets belonging to the employer, customers, suppliers, co-workers, or the company’s clients.

Common examples include:

Taking cash from the register;
Pocketing customer payments;
Stealing inventory or supplies;
Manipulating sales records;
Issuing fake refunds;
Using company funds for personal expenses;
Diverting company deposits to a personal account;
Taking company equipment;
Stealing fuel, tools, gadgets, or merchandise;
Using company credit cards without authority;
Removing confidential files;
Selling company property without permission;
Misusing petty cash;
Falsifying receipts or liquidation reports;
Creating ghost employees or fake suppliers;
Diverting commissions;
Unauthorized withdrawals or fund transfers;
Taking trade secrets or customer lists;
Using company data after resignation;
Colluding with outsiders to defraud the company.

The exact legal classification depends on how the property came into the employee’s possession, whether there was trust or confidence, whether documents were falsified, and whether deception was used.

III. Theft, Qualified Theft, and Estafa: The Core Distinctions

Employee theft cases often revolve around whether the conduct is simple theft, qualified theft, or estafa.

A. Theft

Theft generally involves taking personal property belonging to another, with intent to gain, without the owner’s consent, and without violence or intimidation against persons or force upon things.

In the employment setting, theft may apply where the employee takes company property or money without authority.

Examples:

A warehouse employee secretly takes company goods.
A cashier takes money from the cash drawer.
An office employee takes a company laptop and refuses to return it.
A delivery employee takes items from packages.

B. Qualified Theft

Qualified theft is a more serious form of theft. In employment-related cases, it may arise when the theft is committed with grave abuse of confidence. The employment relationship can be relevant because certain employees are given access, custody, or trust over company property.

Examples may include:

A cashier entrusted with money steals collections.
A bookkeeper manipulates records and takes funds.
A store manager takes inventory under his custody.
A company treasurer diverts company funds.
A sales agent receives customer payments and keeps them.

The key issue is not merely that the offender is an employee. The prosecution must show that the position involved trust or confidence and that the employee gravely abused that confidence in taking the property.

C. Estafa

Estafa generally involves fraud or abuse of confidence resulting in damage to another. In employment cases, estafa may arise when the employee receives money, goods, or property under an obligation to deliver, return, account for, or apply it to a specific purpose, and then misappropriates or converts it.

Examples:

A collector receives customer payments for remittance to the company but keeps them.
An employee receives funds for a business purpose and uses them personally.
A company representative receives goods for delivery but sells them and keeps the proceeds.
An employee obtains money by deceit, false reports, or fraudulent reimbursement claims.

The difference between theft and estafa can be subtle. A simplified distinction is this: in theft, the taking is without consent; in estafa by misappropriation, the employee may have initially received the property lawfully but later converted it to personal use.

IV. Other Possible Crimes

Employee theft may involve other offenses depending on the facts.

A. Falsification of Documents

If the employee falsifies receipts, invoices, payroll records, delivery receipts, liquidation reports, vouchers, accounting entries, or signatures, falsification may be charged separately or together with theft or estafa.

B. Use of Falsified Documents

An employee who knowingly uses falsified documents may incur liability even if another person prepared the document.

C. Computer-Related Fraud or Cybercrime

If the theft involves unauthorized access, manipulation of electronic records, fraudulent online transfers, alteration of digital data, hacking, or misuse of company systems, cybercrime laws may become relevant.

Examples:

Manipulating point-of-sale records;
Altering digital inventory files;
Accessing company accounts without authority;
Diverting online payments;
Using another employee’s login credentials;
Creating fake digital approvals;
Tampering with payroll software.

D. Access Device Fraud

If the employee misuses company credit cards, debit cards, payment credentials, online banking credentials, or access devices, special laws on access devices may apply.

E. Data Privacy Violations

If the employee steals or misuses personal data, customer records, employee records, patient information, financial information, or identity documents, data privacy issues may arise.

F. Unfair Competition or Trade Secret Misuse

If the employee takes confidential business information, customer lists, pricing data, supplier lists, technical processes, source code, or trade secrets for use by a competitor or new business, civil and possibly criminal issues may arise.

G. Malversation

Malversation generally concerns public funds or property and is more relevant to public officers or persons accountable for public funds. It may arise in government employment or public-sector contexts, not ordinary private employment.

V. Employment Consequences: Just Cause for Dismissal

Under Philippine labor law, an employee may be dismissed for just causes, including serious misconduct, willful breach of trust, fraud, commission of a crime against the employer or the employer’s representative, and analogous causes.

Employee theft may support dismissal under one or more just causes.

A. Serious Misconduct

Theft from an employer may constitute serious misconduct because it is a wrongful act connected with the employee’s work and shows unfitness to continue employment.

B. Fraud or Willful Breach of Trust

This is especially relevant for positions of trust and confidence, such as cashiers, managers, accountants, collectors, inventory custodians, payroll personnel, finance staff, purchasing personnel, auditors, and employees with access to company funds or property.

C. Loss of Trust and Confidence

Employers may dismiss employees holding positions of trust when there is a willful breach of trust founded on clearly established facts. The loss of trust must not be arbitrary, simulated, or based on mere suspicion.

D. Commission of a Crime Against the Employer

If the employee commits theft, estafa, falsification, or another crime against the employer or its representatives, this may be a ground for dismissal.

VI. Procedural Due Process in Dismissal Cases

Even if theft appears clear, the employer must still observe procedural due process before dismissing the employee.

The usual process involves:

First written notice, stating the specific acts or omissions charged and giving the employee an opportunity to explain;
Opportunity to be heard, usually through a written explanation and, when appropriate, a conference or hearing;
Evaluation of evidence by the employer;
Second written notice, stating the decision and the reasons for dismissal, if dismissal is imposed.

Failure to observe due process may expose the employer to liability even if there was a valid ground for dismissal. Substantive validity and procedural validity are separate issues.

VII. Preventive Suspension

An employer may place an employee under preventive suspension when the employee’s continued presence poses a serious and imminent threat to the employer’s life or property, or to co-workers.

In theft cases, preventive suspension may be justified when the employee continues to have access to:

Cash;
Inventory;
Accounting records;
Company systems;
Confidential documents;
Customers;
Company bank accounts;
Evidence or witnesses.

Preventive suspension should not be used as punishment before a decision is made. It is a protective measure while investigation is pending.

VIII. Resignation After Theft Is Discovered

A common scenario is that an employee resigns after being confronted with suspected theft. The employee may hope that resignation ends the matter. Legally, resignation does not automatically erase liability.

Resignation may affect employment status, but it does not necessarily prevent:

Internal investigation;
Civil demand for return or payment;
Filing of a criminal complaint;
Filing of an insurance claim;
Reporting to regulators, when applicable;
Recovery of company property;
Withholding of final pay subject to legal limits;
Issuance of a certificate of employment with truthful employment dates and position.

If a criminal offense was committed, resignation does not extinguish criminal liability.

IX. Can an Employee Resign to Avoid Dismissal?

An employee may submit a resignation, but the employer is not always required to treat the matter as clean resignation if there is already an ongoing investigation for serious misconduct or theft.

Possible situations include:

A. Resignation Before Discovery

If the employee resigns before the theft is discovered, the employer may still investigate and later pursue civil or criminal remedies.

B. Resignation After Notice to Explain

If the employee resigns after receiving a notice to explain, the employer may either accept the resignation, continue the administrative process, or document the separation carefully depending on company policy and circumstances.

C. Forced Resignation

If the employer coerces resignation without proper basis, the employee may later claim constructive dismissal. Employers should avoid forcing resignation as a shortcut.

D. Voluntary Resignation With Settlement

The parties may agree on resignation and restitution, but this should be documented carefully. Even then, criminal liability may not automatically disappear.

X. Effect of Resignation on Criminal Liability

Criminal liability is based on the act committed, not on whether the employee remains employed. If the elements of theft, qualified theft, estafa, falsification, or another crime are present, resignation does not erase the offense.

An employee cannot avoid criminal liability simply by saying:

“I already resigned.”
“I am no longer connected with the company.”
“This is an internal matter.”
“I already returned part of the money.”
“The company accepted my resignation.”
“I signed a quitclaim.”
“I promised to pay.”

These facts may affect evidence, negotiations, civil liability, or the complainant’s willingness to pursue the case, but they do not automatically extinguish criminal liability.

XI. Effect of Payment or Restitution

Payment or restitution is important, but it does not necessarily erase criminal liability.

A. Before Complaint

If the employee returns the property or money before a criminal complaint is filed, the employer may decide not to pursue prosecution. However, the act may still have been committed.

B. After Complaint

If payment is made after a complaint is filed, it may be considered in settlement discussions or in the assessment of civil liability, but it does not automatically result in dismissal of the criminal case.

C. After Conviction

Restitution may affect civil liability, mitigation, or practical outcomes, but it does not automatically erase a conviction.

D. Full Payment vs Partial Payment

Full payment may reduce the employer’s financial loss, while partial payment may serve as evidence that the employee acknowledges some accountability, depending on wording and context. Employees should be careful when signing acknowledgments.

XII. Affidavit of Desistance

An employer or complainant may execute an affidavit of desistance stating that they are no longer interested in pursuing the case. However, in criminal cases, the offense is generally considered an offense against the State, not merely against the private complainant.

An affidavit of desistance may influence the prosecutor or court, especially when evidence depends heavily on the complainant. But it does not automatically require dismissal if the State has sufficient evidence to proceed.

XIII. Settlement Agreements

Employers and employees sometimes enter into settlement agreements after theft is discovered. These may include:

Return of property;
Payment schedule;
Admission or non-admission clauses;
Resignation;
Release and quitclaim;
Confidentiality;
Non-disparagement;
Turnover of passwords, files, and equipment;
Agreement not to contact clients;
Agreement not to disclose company information;
Stipulation on what happens upon default.

Settlement can resolve civil claims, but it must be carefully drafted. A private settlement cannot automatically prevent the government from prosecuting a crime if a complaint has already been filed or if the offense is independently pursued.

XIV. Quitclaims and Waivers

A quitclaim usually releases claims arising from employment, such as unpaid wages, benefits, or labor claims. It does not automatically release an employee from criminal liability for theft or fraud unless the wording clearly addresses civil claims connected to the incident, and even then it cannot bind the State in a criminal prosecution.

Employers should avoid using vague quitclaims when theft is involved. Employees should avoid signing documents that contain admissions without understanding their consequences.

XV. Final Pay and Employee Theft

When an employee resigns or is dismissed, final pay may include unpaid wages, pro-rated 13th month pay, unused leave benefits convertible to cash under company policy, and other amounts due.

If the employee owes money or property to the employer, the employer may want to deduct from final pay. Deductions are legally sensitive. The employer should have a lawful basis, such as:

Written authorization;
Existing company policy;
Clear and liquidated accountability;
Established debt;
Lawful deduction rules;
Final settlement agreement.

Employers should be cautious in making unilateral deductions, especially if the amount is disputed. Employees should request a written breakdown of final pay and any deductions.

XVI. Certificate of Employment

An employee, even one dismissed for theft, may request a certificate of employment. A certificate of employment generally states the employee’s dates of employment and position. Employers should be careful about including accusations, defamatory statements, or unproven allegations.

If a criminal or administrative case is ongoing, the employer should avoid statements that may be considered malicious or unsupported.

XVII. Burden of Proof in Employment Cases

In labor cases involving dismissal, the employer bears the burden of proving that the dismissal was valid. The standard in administrative employment proceedings is different from criminal proceedings.

For dismissal, the employer must show a just cause supported by substantial evidence. Substantial evidence is relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

This is lower than the criminal standard of proof beyond reasonable doubt.

XVIII. Burden of Proof in Criminal Cases

In criminal cases, the prosecution must prove guilt beyond reasonable doubt. This is a much higher standard than substantial evidence.

This means that an employee may be validly dismissed based on substantial evidence, but may still be acquitted in a criminal case if guilt is not proven beyond reasonable doubt.

Likewise, the dismissal of a labor case does not automatically prevent criminal prosecution if the criminal elements can be proven.

XIX. Independent Nature of Labor, Civil, and Criminal Cases

A single act of employee theft may produce multiple cases:

Labor case — whether dismissal was valid;
Criminal case — whether a crime was committed;
Civil case or civil aspect — whether the employee must return money or pay damages.

These cases may proceed independently, subject to procedural rules.

An employer may dismiss an employee and file a criminal complaint. An employee may challenge the dismissal before labor authorities while defending against the criminal complaint. The results may differ because the issues and standards of proof differ.

XX. Internal Investigation

A proper internal investigation is critical. Employers should avoid acting on rumor or anger. A disciplined investigation may include:

Securing physical evidence;
Preserving CCTV footage;
Auditing records;
Reviewing access logs;
Interviewing witnesses;
Obtaining written statements;
Reconciling inventory;
Reviewing cashier reports;
Freezing system access;
Issuing a notice to explain;
Conducting a hearing or conference;
Documenting findings;
Preparing a decision.

Poor investigation can weaken both dismissal and criminal cases.

XXI. Evidence in Employee Theft Cases

Useful evidence may include:

CCTV recordings;
Cash count reports;
Inventory records;
Audit reports;
Sales invoices;
Delivery receipts;
Official receipts;
Customer complaints;
Bank deposit slips;
E-wallet or online transfer records;
Payroll records;
Emails and messages;
System logs;
Access card records;
Witness statements;
Admissions;
Written explanations;
Company policies;
Employment contract;
Job description;
Turnover documents;
Asset accountability forms.

Evidence should be preserved in a way that maintains authenticity and chain of custody, especially if criminal prosecution is contemplated.

XXII. Employee Admissions

Employees sometimes admit wrongdoing during confrontation. Employers should document admissions carefully and lawfully.

An admission may appear in:

Written explanation;
Email;
Chat message;
Promissory note;
Payment agreement;
Apology letter;
Acknowledgment of accountability;
Recorded meeting;
Settlement agreement.

However, employers should avoid coercion, threats, intimidation, or forced confessions. An involuntary or improperly obtained admission may be challenged.

Employees should avoid signing documents they do not understand, especially documents admitting theft, fraud, or criminal intent.

XXIII. Promissory Notes

An employee who signs a promissory note may be acknowledging a debt. However, a promissory note does not necessarily transform a criminal matter into a purely civil one. If the underlying facts show theft, estafa, or falsification, criminal liability may still be pursued.

From the employer’s side, a promissory note may help recover money but may also affect how the case is framed. If poorly drafted, it may create arguments that the matter was treated as a loan or civil debt rather than theft.

From the employee’s side, a promissory note may be used as evidence of acknowledgment. It should not be signed without understanding its legal effect.

XXIV. Common Employer Mistakes

Employers handling employee theft should avoid these mistakes:

Dismissing the employee without due process;
Failing to issue a proper notice to explain;
Relying only on suspicion;
Publicly shaming the employee;
Forcing a confession;
Forcing resignation;
Threatening illegal harm;
Detaining the employee without lawful basis;
Searching personal belongings unlawfully;
Deducting from wages without proper basis;
Failing to preserve evidence;
Allowing the employee continued access to systems;
Filing a weak criminal complaint without evidence;
Using defamatory language in announcements;
Failing to distinguish theft from estafa;
Accepting settlement without documentation;
Forgetting to secure company passwords and assets.

A valid theft concern does not excuse unlawful employer conduct.

XXV. Common Employee Mistakes

Employees accused of theft should avoid these mistakes:

Resigning without understanding the consequences;
Assuming resignation ends liability;
Signing admissions under pressure;
Signing promissory notes without legal advice;
Destroying or deleting evidence;
Returning property secretly without documentation;
Making false explanations;
Threatening witnesses;
Ignoring notices from the employer;
Ignoring subpoenas from prosecutors;
Posting about the case online;
Contacting customers or co-workers inappropriately;
Using company data after separation;
Assuming payment automatically cancels a criminal case;
Failing to keep copies of documents.

An employee should respond carefully, truthfully, and with proper documentation.

XXVI. Employee Theft and Constructive Dismissal Claims

Sometimes an employee accused of theft resigns and later claims constructive dismissal. The outcome depends on the facts.

A resignation may be considered involuntary if the employer made continued employment impossible, unbearable, or unlikely through coercion, threats, humiliation, or illegal pressure. But if the employee voluntarily resigned after being confronted with evidence, the claim may be weaker.

Employers should therefore avoid statements such as:

“Resign now or we will jail you immediately.”
“Sign this or we will embarrass you.”
“Admit everything or we will harm your family.”
“You cannot leave until you sign.”

The employer may explain that investigation and legal remedies are possible, but should avoid coercive tactics.

XXVII. Search of Employee Bags, Lockers, and Devices

Workplace searches can be legally sensitive. Employers may have policies allowing inspection of company premises, bags, lockers, vehicles, or devices, but searches should be reasonable, non-discriminatory, and respectful of privacy.

Important distinctions:

Company-issued devices may be subject to company access policies.
Personal devices are more privacy-sensitive.
Lockers on company premises may be inspected under policy, but procedures matter.
Searches should ideally be witnessed and documented.
Force, intimidation, or public humiliation should be avoided.
Evidence obtained unlawfully may create legal issues.

Employers should have clear workplace policies on inspections, monitoring, and company property.

XXVIII. CCTV and Monitoring

CCTV footage is often important in theft cases. Employers may use CCTV for security, but they should comply with privacy principles. Employees should generally be aware that CCTV is used in workplace areas where security monitoring is expected.

CCTV should not be installed in places where employees have a high expectation of privacy, such as restrooms or changing areas.

CCTV evidence should be preserved promptly because many systems overwrite recordings after a limited time.

XXIX. Digital Evidence

Employee theft increasingly involves digital evidence. Employers should preserve:

Login records;
IP logs;
System access history;
File download logs;
Email headers;
Chat messages;
Cloud access records;
POS records;
ERP logs;
Online banking logs;
Device assignments;
Audit trails.

Digital evidence should not be casually altered. IT personnel should preserve copies and document how the evidence was obtained.

XXX. Company Property After Resignation

Upon resignation or dismissal, an employee must return company property, including:

Laptops;
Phones;
ID cards;
Keys;
Uniforms;
Tools;
Documents;
Files;
Vehicles;
Credit cards;
Access cards;
Storage devices;
Confidential records.

Failure to return property may create civil or criminal issues depending on circumstances. A clearance process helps document what has been returned and what remains outstanding.

XXXI. Clearance Process

A clearance process allows the employer to verify that the separating employee has returned property and settled accountabilities. It may involve departments such as HR, finance, IT, legal, operations, and administration.

Clearance should not be used to unlawfully withhold wages indefinitely. However, it may be used to identify outstanding obligations and document unresolved accountabilities.

XXXII. Company Loans vs Employee Theft

Employers should distinguish between legitimate employee loans and theft.

A company loan exists where the employer voluntarily lends money to the employee, usually documented by a loan agreement or payroll deduction authorization.

Employee theft involves unauthorized taking, misappropriation, or conversion.

Confusion may arise where an employee takes funds and later says, “I intended to treat it as a loan.” The employer is not required to accept this explanation if there was no authorization.

XXXIII. Negligence vs Theft

Not every loss is theft. Some workplace losses are caused by negligence, error, poor controls, or incompetence.

Examples:

Cash shortage due to wrong change;
Inventory discrepancy due to encoding error;
Lost equipment due to carelessness;
Failed collection due to poor follow-up;
Mistaken payment processing.

Theft requires intent to gain or fraudulent conversion. Employers should investigate whether the loss was intentional before accusing the employee of theft.

Wrongly accusing an employee of theft can expose the employer to labor, civil, or reputational consequences.

XXXIV. Group Theft and Conspiracy

Employee theft may involve multiple employees or outsiders. There may be conspiracy or cooperation where employees act together to steal, conceal records, manipulate inventory, approve fake transactions, or divide proceeds.

Evidence may include:

Coordinated messages;
Repeated irregular approvals;
Unusual access patterns;
False documents;
Witness accounts;
Shared proceeds;
Similar transactions;
Concealment behavior.

Each person’s participation must be established. Mere association with a guilty employee is not enough.

XXXV. Supervisory and Managerial Employees

Supervisors and managers are often held to a higher standard of trust. Theft or fraud by a managerial employee can justify loss of trust and confidence more readily because of the position’s authority.

Examples:

Store managers manipulating inventory reports;
Finance managers approving false payments;
HR officers creating ghost employees;
Purchasing heads receiving kickbacks;
Operations managers diverting company resources.

The higher the trust reposed in the employee, the more serious the breach.

XXXVI. Cashiers, Collectors, and Accountable Employees

Cashiers, collectors, tellers, sales agents, and other accountable employees are common subjects of theft or estafa cases because they handle money or property.

Important evidence includes:

Cash count sheets;
Daily sales reports;
Collection receipts;
Acknowledgment receipts;
Customer confirmations;
Deposit records;
Shortage reports;
Turnover logs;
POS records;
Remittance schedules.

If an accountable employee cannot explain shortages, employment liability may arise. But criminal liability still requires proof of the elements of the crime.

XXXVII. Sales Agents and Customer Payments

A frequent issue is when a sales agent or collector receives money from a customer but fails to remit it to the company. Depending on the facts, this may be treated as estafa, qualified theft, or another offense.

Key questions include:

Was the employee authorized to receive payments?
Was the money received for the employer?
Was there an obligation to remit?
Did the employee issue an official receipt?
Did the employee conceal the payment?
Did the employee use the money personally?
Was the customer misled?
Were records falsified?

Customer statements are often important in these cases.

XXXVIII. Inventory Theft

Inventory theft may involve taking goods, manipulating stock cards, false deliveries, fake returns, collusion with guards, or underreporting sales.

Important evidence includes:

Physical inventory counts;
Stock movement records;
Receiving reports;
Delivery receipts;
CCTV;
Gate pass records;
Security logs;
Customer orders;
Supplier documents;
System audit trails;
Witness testimony.

Employers should be careful to distinguish theft from shrinkage, spoilage, breakage, or inventory control errors.

XXXIX. Payroll Fraud

Payroll-related theft may involve:

Ghost employees;
Inflated overtime;
Fake commissions;
Unauthorized salary adjustments;
Manipulated attendance;
Payment to resigned employees;
Diversion of payroll funds;
Use of another employee’s payroll account.

Possible offenders may include HR staff, payroll officers, supervisors, approving managers, or employees who knowingly receive improper payments.

XL. Procurement and Kickbacks

Procurement-related wrongdoing may include kickbacks, overpricing, fake suppliers, conflict of interest, rigged bidding, false deliveries, and inflated invoices.

Not all procurement violations are theft, but they may involve fraud, estafa, falsification, corruption, breach of company policy, or civil liability.

Employers should examine:

Supplier accreditation;
Purchase orders;
Bidding documents;
Canvass sheets;
Delivery receipts;
Inspection reports;
Payment vouchers;
Relationship between employee and supplier;
Bank records;
Communications.

XLI. Trade Secrets, Client Lists, and Confidential Information

An employee who resigns and takes client lists, pricing strategies, source code, business plans, formulas, designs, or confidential data may face liability even if no physical property was taken.

Possible claims include:

Breach of confidentiality;
Violation of employment contract;
Unfair competition;
Data privacy violations;
Intellectual property issues;
Civil damages;
Criminal liability in specific circumstances.

Employers should use confidentiality agreements, access controls, and exit protocols to protect sensitive information.

XLII. Employee Theft After Resignation

Theft may occur even after resignation if the former employee retains access to company systems, customers, files, or property.

Examples:

Former employee uses old passwords to access company accounts;
Former employee diverts customers;
Former employee uses company documents;
Former employee sells retained inventory;
Former employee continues collecting payments from customers;
Former employee keeps a company laptop and deletes files;
Former employee uses confidential pricing data in a competing business.

Employers should immediately revoke access upon separation.

XLIII. Criminal Complaint Process

A private employer usually initiates a criminal case by filing a complaint with the proper prosecutor’s office or law enforcement agency.

A typical process may include:

Preparation of complaint-affidavit;
Attachment of evidence;
Filing with the prosecutor or law enforcement;
Submission of counter-affidavit by the respondent;
Reply-affidavit, if allowed or required;
Prosecutor’s resolution;
Filing of information in court if probable cause is found;
Arraignment and trial;
Judgment.

The prosecutor determines whether there is probable cause. The court determines guilt beyond reasonable doubt.

XLIV. Complaint-Affidavit

A complaint-affidavit should clearly state:

Identity of complainant;
Relationship of employee to employer;
Position and duties of employee;
Property or money involved;
How the employee obtained access;
Date, time, and place of acts;
Amount or value involved;
Evidence of taking, misappropriation, or fraud;
Demand to return or account, if relevant;
Failure or refusal to return, if relevant;
Documents supporting the complaint.

The complaint should avoid exaggeration and should focus on provable facts.

XLV. Demand Letter

A demand letter may be useful, especially in estafa-type cases where failure to account after demand may support the claim of misappropriation. However, demand is not always required for every theft case.

A demand letter may ask the employee to:

Return property;
Account for funds;
Explain shortages;
Pay the amount due;
Turn over documents;
Attend a conference;
Cease use of company data.

The demand should be written professionally and should not contain unlawful threats.

XLVI. Prescription of Crimes

Crimes have prescriptive periods, meaning the State must prosecute within a legally prescribed time. The period depends on the offense and penalty. Employers should not delay if they intend to file a complaint.

Delay can also weaken evidence because witnesses forget, documents are lost, CCTV is overwritten, and employees become harder to locate.

XLVII. Civil Liability Arising From Crime

A person criminally liable is generally also civilly liable. Civil liability may include:

Restitution of property;
Payment of value if return is impossible;
Reparation for damage;
Indemnification for consequential damages;
Interest;
Other damages, depending on the case.

The civil aspect may be pursued with the criminal case unless reserved, waived, or separately filed according to procedural rules.

XLVIII. Employer’s Right to Recover Losses

An employer may pursue recovery through:

Internal settlement;
Final pay deductions if legally permitted;
Civil action;
Criminal case with civil aspect;
Insurance claim;
Bond claim;
Demand against accountable officer;
Action against co-conspirators;
Action against third parties who benefited.

Employers should document the loss carefully and prove the amount claimed.

XLIX. Employee Defenses

An accused employee may raise defenses such as:

No taking occurred;
No intent to gain;
Property was authorized to be used;
Money was already remitted;
Shortage was due to error;
Loss was due to negligence, not theft;
Another person had access;
Records are inaccurate;
Evidence was fabricated;
Confession was coerced;
The employee was framed;
The amount claimed is inflated;
The matter is civil, not criminal;
The employee acted under instruction;
The property was returned;
There was no grave abuse of confidence;
The elements of the charged offense are absent.

The strength of any defense depends on evidence.

L. Employer Defenses in Labor Cases

If the employee files an illegal dismissal case, the employer may defend by showing:

Valid just cause;
Clear evidence of wrongdoing;
Proper notice to explain;
Opportunity to be heard;
Written decision;
Company policy violated;
Position of trust;
Established loss or irregularity;
Good faith investigation;
Proportionality of penalty.

Employers should not rely solely on the existence of a criminal complaint. Filing a criminal complaint does not automatically prove valid dismissal.

LI. Preventing Employee Theft

Employers can reduce theft risk through strong internal controls:

Segregation of duties;
Dual approvals;
Cash count procedures;
Inventory audits;
CCTV in appropriate areas;
Access controls;
Regular reconciliation;
Surprise audits;
Whistleblower channels;
Rotation of duties;
Mandatory leave for sensitive positions;
Clear policies;
Background checks where lawful;
Asset accountability forms;
Conflict-of-interest disclosures;
Vendor accreditation controls;
Exit clearance procedures;
Immediate access revocation upon separation.

Prevention is often more effective than prosecution.

LII. Workplace Policies

A company should have written policies covering:

Theft and dishonesty;
Handling of cash and inventory;
Use of company property;
Reimbursement and liquidation;
Confidential information;
Data privacy;
IT system access;
Conflict of interest;
Gifts and kickbacks;
Searches and inspections;
CCTV and monitoring;
Disciplinary procedure;
Clearance and turnover;
Final pay deductions;
Whistleblower reporting.

Policies should be communicated to employees and consistently enforced.

LIII. Role of HR, Legal, Finance, and Security

Employee theft cases require coordination.

HR

Handles notices, hearings, documentation, disciplinary action, and employee records.

Legal

Assesses criminal, civil, labor, privacy, and settlement issues.

Finance

Quantifies loss, audits records, and traces funds.

Security

Preserves physical evidence, CCTV, access logs, and incident reports.

IT

Secures accounts, preserves digital evidence, and revokes access.

A disorganized response can damage the case.

LIV. Confidentiality During Investigation

Employers should limit discussion of theft allegations to those who need to know. Public accusations can expose the employer to defamation, privacy, labor, or morale problems.

Employees under investigation should also avoid posting accusations, threats, or confidential information online.

LV. Media, Social Media, and Reputation

Employee theft cases should not be tried on social media. Employers should avoid posting photos, names, CCTV clips, or accusations online. Employees should also avoid posting company documents or internal communications.

Social media posts can create separate liability for defamation, privacy violations, breach of confidentiality, or cyber-related offenses.

LVI. Special Issues for Public Employees

If the employee works in government or handles public funds, additional rules may apply. The case may involve administrative discipline, criminal liability under special laws, malversation, graft, falsification, or other public accountability rules.

Public officers are subject to higher standards of accountability, and resignation does not necessarily prevent administrative or criminal proceedings.

LVII. Special Issues for Banks, Financial Institutions, and E-Wallets

Employee theft in financial institutions may involve regulatory reporting, anti-money laundering controls, customer protection, data privacy, and internal audit requirements.

Examples include:

Unauthorized withdrawals;
Manipulation of customer accounts;
Unauthorized fund transfers;
Misuse of customer data;
Fraudulent loan approvals;
ATM or card-related fraud;
E-wallet account manipulation.

These cases require careful evidence handling and may trigger reports to regulators or law enforcement.

LVIII. Special Issues for BPOs and Data-Handling Companies

In BPOs and data-heavy industries, employee theft may involve customer information rather than physical property. This may include:

Copying customer databases;
Selling personal data;
Taking screenshots of client systems;
Using client credentials;
Accessing accounts without business need;
Diverting customer payments;
Identity theft.

Data privacy and contractual obligations to clients may be central.

LIX. Special Issues for Retail, Restaurants, and Small Businesses

In smaller businesses, theft cases often involve cash, inventory, and informal procedures. Employers should still observe due process and document evidence.

Common issues include:

No written job descriptions;
No formal cash accountability forms;
Poor inventory records;
Family-like workplace relationships;
Verbal agreements;
Lack of CCTV;
Informal salary deductions;
Emotional confrontations.

Small businesses should avoid shortcuts. Even a small theft case can become legally complicated if handled improperly.

LX. Employee Theft and Moral Turpitude

Theft and fraud-related offenses may affect future employment, professional licensing, immigration matters, and credibility. Employees should take allegations seriously because the consequences may go beyond the current job.

Employers should also be cautious in giving references. They should provide truthful information but avoid malicious or unproven statements.

LXI. Practical Employer Checklist

When employee theft is suspected, an employer should:

Secure evidence immediately.
Restrict access to cash, inventory, and systems.
Avoid public accusations.
Conduct a preliminary audit.
Identify the employee’s duties and accountabilities.
Issue a notice to explain.
Allow the employee to respond.
Conduct a hearing or conference if appropriate.
Evaluate evidence objectively.
Issue a written decision.
Demand return or accounting of property.
Decide whether to file a criminal complaint.
Preserve all documents and digital evidence.
Coordinate HR, legal, finance, IT, and security.
Document any settlement carefully.
Avoid unlawful deductions or coercive tactics.

LXII. Practical Employee Checklist

If accused of employee theft, an employee should:

Read the notice carefully.
Ask for copies of documents relied upon, if appropriate.
Submit a written explanation on time.
Avoid destroying evidence.
Avoid signing admissions under pressure.
Keep copies of all notices and communications.
Attend the hearing or conference.
Return company property with written acknowledgment.
Clarify any amount claimed.
Request a breakdown of alleged shortages.
Avoid social media posts about the case.
Seek legal advice if criminal liability is possible.
Respond to prosecutor subpoenas if a complaint is filed.
Keep proof of payments, remittances, or authorizations.
Do not assume resignation ends the matter.

LXIII. Sample Notice to Explain

Subject: Notice to Explain Regarding Alleged Misappropriation of Company Funds

Dear [Employee Name]:

The company has received information and documents indicating that on or about [date/s], you allegedly received and/or handled company funds in the amount of ₱[amount] but failed to remit, account for, or return the same.

Initial records show the following: [brief statement of facts and documents].

Your acts, if proven, may constitute serious misconduct, fraud, willful breach of trust, loss of confidence, violation of company policy, and/or commission of an offense against the company.

You are directed to submit a written explanation within [number] days from receipt of this notice, stating why no disciplinary action should be taken against you. You may attach supporting documents and identify witnesses, if any.

You are also directed to attend an administrative conference on [date, time, place/platform], where you will be given an opportunity to be heard.

This notice is issued without prejudice to the company’s rights and remedies under law.

Sincerely, [Authorized Representative]

LXIV. Sample Demand Letter

Subject: Demand to Account for and Return Company Funds/Property

Dear [Employee Name]:

Our records show that you received, handled, or were accountable for [funds/property] belonging to the company in the amount/value of ₱[amount], arising from [brief description].

Despite demand and/or despite the obligation to account for the same, you have failed to remit, return, or satisfactorily explain the discrepancy.

You are hereby demanded to account for and return the amount/property within [period] from receipt of this letter. This demand is without prejudice to the company’s right to pursue administrative, civil, and criminal remedies under applicable law.

Sincerely, [Authorized Representative]

LXV. Sample Settlement Clauses

A settlement agreement may include clauses such as:

The employee acknowledges receipt or accountability for the amount of ₱[amount].
The employee agrees to pay the amount according to a schedule.
Payment shall be made only through official company channels.
Failure to pay any installment shall make the entire balance due.
The employee shall return all company property and confidential information.
The agreement settles civil monetary claims between the parties, subject to its terms.
Nothing in the agreement shall be construed as a waiver of rights that cannot legally be waived.
The parties agree to keep the terms confidential, except as required by law.
The employee confirms that the agreement was signed voluntarily.

Settlement language should be tailored to the facts and reviewed carefully.

LXVI. Key Legal Principles

Several principles are important:

Employee theft can result in employment, civil, and criminal liability.
Resignation does not erase criminal liability.
Payment does not automatically erase criminal liability.
Settlement may resolve civil claims but does not necessarily bind the State.
Employers must still observe due process before dismissal.
Labor cases and criminal cases have different standards of proof.
Theft, qualified theft, and estafa have different elements.
Not every shortage is theft.
Evidence must be preserved and documented.
Both employer and employee should avoid coercion, public shaming, and unsupported accusations.

LXVII. Frequently Asked Questions

1. Can an employee be criminally charged after resigning?

Yes. Resignation does not prevent criminal prosecution if the facts support a criminal offense.

2. Can an employer still dismiss an employee who already resigned?

It depends on timing and facts. If resignation has already taken effect, dismissal may be moot as an employment action, but the employer may still document the incident and pursue civil or criminal remedies. If the disciplinary process was pending before the resignation took effect, the employer should handle the matter carefully.

3. Does returning the stolen money cancel the case?

Not automatically. Restitution may affect settlement or civil liability, but it does not automatically extinguish criminal liability.

4. Is employee theft always qualified theft?

No. Qualified theft requires qualifying circumstances, such as grave abuse of confidence. Not every employee theft is automatically qualified theft.

5. Is failure to remit collections theft or estafa?

It depends on how the money was received and the employee’s obligation. It may be estafa, qualified theft, or another offense depending on the facts.

6. Can the employer deduct the amount from final pay?

Only if there is a lawful basis and the deduction complies with applicable rules. Unilateral deductions for disputed amounts may be challenged.

7. Can the employer force the employee to sign a confession?

No. Forced confessions are improper and may be challenged.

8. Can the employer post the employee’s name online?

This is risky and may create defamation, privacy, or labor issues. Employers should avoid public shaming.

9. Can the employee be detained at the workplace?

Employers should be extremely careful. Unlawful detention or coercion can create liability. If a crime is ongoing or just occurred, law enforcement should be involved.

10. Can a labor case and criminal case proceed at the same time?

Yes. They involve different issues and standards of proof.

LXVIII. Conclusion

Employee theft in the Philippines is not merely a workplace discipline issue. It can lead to dismissal, restitution, civil liability, and criminal prosecution. The fact that the employee resigns does not automatically end the matter. The fact that the employee pays or promises to pay does not automatically erase criminal liability. The employer’s acceptance of resignation or settlement may affect the practical handling of the case, but it does not necessarily extinguish the State’s interest in prosecuting a crime.

For employers, the best approach is to investigate carefully, preserve evidence, observe due process, avoid coercion, and choose remedies based on facts and legal advice. For employees, the best approach is to respond truthfully, preserve documents, avoid signing harmful admissions without understanding them, and recognize that resignation is not a shield from liability.

The central rule is simple: employment separation does not erase prior misconduct, and criminal liability depends on the act committed, not on whether the employment relationship continues.