A Philippine Legal Guide

A demand letter that accuses a person of qualified theft, estafa, and even threatens revocation of a PRC license is meant to create pressure. Sometimes that pressure is justified. Sometimes it is exaggerated. Sometimes it is legally confused. A careful assessment requires separating what is rhetoric from what is actually actionable under Philippine law.

This article explains how to evaluate that kind of letter in the Philippine legal context, especially when the accusations are used as leverage in an employment, accounting, property, agency, collections, professional, or business dispute.

This is a general legal discussion based on Philippine legal principles and commonly understood doctrine up to August 2025. It is not a substitute for case-specific legal advice.

I. What a demand letter really is

A demand letter is usually not a court judgment, not a criminal charge, and not proof of liability. It is a private assertion of claims and a demand for action, commonly payment, return of property, accounting, explanation, settlement, resignation, or admission.

In the Philippines, a demand letter can serve several functions:

to formally notify the recipient of a claim;
to place the recipient in delay in some civil obligations where demand is legally relevant;
to create a paper trail before filing a criminal complaint, civil case, administrative complaint, or labor complaint;
to pressure the recipient into settlement by citing criminal exposure or professional consequences.

A threatening demand letter is therefore significant, but it is still only the beginning of a dispute, not the end of it.

II. The first principle: separate the three threats

When a letter mentions all three of these at once, analyze them separately:

Qualified theft This is a criminal accusation involving unlawful taking of personal property, often aggravated by confidence, domestic service, grave abuse of trust, or analogous circumstances.
Estafa This is a criminal accusation involving fraud, deceit, abuse of confidence, misappropriation, conversion, or damage through fraudulent means.
PRC revocation This is not a criminal penalty. It is an administrative or regulatory consequence affecting a professional license, and it depends on the governing law for the profession, PRC rules, and the conduct actually proved.

A common flaw in threatening letters is that they stack accusations without matching the facts to the legal elements of each one.

III. What to do immediately upon receiving the letter

Do these first before analyzing the legal theories in depth:

1. Preserve everything

Keep:

the envelope, email headers, attachments, screenshots, chat logs;
contracts, receipts, vouchers, inventory records, ledgers, turn-over records, audit reports;
company policies, authorizations, job descriptions, board resolutions, acknowledgment receipts;
bank records, deposit slips, invoices, purchase orders, liquidation reports;
prior demands, prior explanations, notices to explain, suspension notices, and clearance documents.

2. Do not destroy or alter records

Inconsistencies, deletions, or retroactive edits can make a defensible case look incriminating.

3. Do not send an emotional reply

A hasty message such as “I will pay na lang,” “I used it temporarily,” or “I admit I was short” can later be characterized as an admission.

4. Build a timeline

Write down:

what property or money is being claimed;
when you received, held, or accessed it;
what authority you had;
when and how it allegedly disappeared, was transferred, or was not accounted for;
who else had access;
what communications occurred before the demand.

5. Identify the role relationship

Ask whether you were:

employee;
cashier;
branch manager;
sales agent;
treasurer;
officer;
contractor;
consignee;
commission-based representative;
bookkeeper;
professional handling client funds or records.

That relationship often determines whether the accusation sounds more like theft, estafa, breach of trust, labor dispute, corporate dispute, or mere civil liability.

6. Get counsel early

This is especially important when the letter threatens criminal charges. A reply made through counsel is often more disciplined and less damaging.

IV. How to read the letter critically

A strong legal demand letter should contain at least these features:

a clear statement of facts;
the dates and transactions involved;
identification of the specific property or money;
the legal basis for each accusation;
the relief demanded;
a deadline;
the consequences threatened if there is no compliance.

Red flags in a weak or overblown letter include:

legal terms thrown together without facts;
no identification of the exact amount or property;
no explanation of how the accused supposedly took, converted, or defrauded;
threats of “automatic imprisonment”;
claims that a PRC license will be “instantly revoked” upon nonpayment;
criminal accusations used purely to collect a debt with no factual basis for deceit, taking, or conversion;
impossible deadlines;
demands to sign an admission or quitclaim immediately.

The more conclusory the letter is, the less persuasive it is as evidence, though it may still signal that a complaint is coming.

V. Qualified theft in Philippine law: what must usually be shown

A. Core idea

Theft generally involves the taking of personal property belonging to another, without consent, with intent to gain. It becomes qualified theft when committed under circumstances that qualify or aggravate it, such as abuse of confidence or similar conditions recognized by law.

B. Typical elements that matter in practice

A complainant usually needs to show:

there was personal property;
it belonged to another;
it was taken without consent;
there was intent to gain;
there was no violence or intimidation against persons and no force upon things in the manner associated with robbery;
a qualifying circumstance existed, often grave abuse of confidence.

C. Why employers often invoke qualified theft

In Philippine workplace disputes, qualified theft is often alleged against:

cashiers;
warehouse personnel;
accounting staff;
branch managers;
collectors;
employees with access to inventory, cash, tools, gadgets, or confidential assets.

The theory is usually that the person had trusted access, then appropriated company property.

D. Key assessment questions

When qualified theft is alleged, ask:

Was there actual taking? Mere shortage, unexplained variance, or failure to liquidate is not automatically proof of unlawful taking.
What exactly was taken? Was it cash, inventory, devices, checks, fuel, supplies, or something else?
Who had custody and access? Exclusive access strengthens the allegation. Shared access weakens it.
Was there authority to possess or transfer the property? Lawful possession can complicate a theft theory.
Is the case really about missing property, or about bad accounting? Poor controls and sloppy documentation are not the same as criminal taking.
Can the complainant prove intent to gain? Intent may be inferred, but it should still connect to conduct, not just suspicion.
What is the qualifying circumstance? A letter that says “qualified theft” but does not explain why it is “qualified” may be overstating the claim.

E. Common defense themes

Depending on the facts, defenses may include:

no taking occurred;
property was received lawfully and later disputed only in accounting;
multiple persons had access;
authority existed for the transfer, release, or use;
the amount is unliquidated or unverified;
there was no intent to gain;
the accusation is really a civil or labor matter disguised as a criminal one.

F. Practical point

Qualified theft is serious because Philippine complainants often use it where there was a relationship of trust. But not every shortage or failure to return company property automatically becomes qualified theft.

VI. Estafa in Philippine law: what must usually be shown

A. Core idea

Estafa generally involves fraud or abuse of confidence causing damage. It is broader than theft in some settings because the person may have initially received the money or property lawfully, but later misappropriated, converted, or fraudulently dealt with it.

B. Why estafa is often alleged

Estafa is commonly alleged when:

money was entrusted for a specific purpose;
collections were received and not remitted;
funds were advanced and not liquidated;
goods were entrusted on consignment;
a person induced another through deceit to release money or property;
checks, representations, or false pretenses were used.

C. Practical categories often seen

In real disputes, estafa allegations commonly fall into two broad patterns:

Abuse of confidence / misappropriation or conversion The accused was entrusted with money, goods, or documents and allegedly misused or failed to return them.
Deceit / false pretenses The complainant alleges that the accused lied or made fraudulent representations to obtain money or property.

D. Key assessment questions

When estafa is alleged, ask:

How did the accused receive the money or property? Was it by trust, agency, administration, employment, deposit, commission, or another juridical basis?
Was the property entrusted for a specific purpose? Specificity matters. “For remittance,” “for liquidation,” “for delivery,” “for safekeeping,” or “for client payment” are different from a general debt.
Was there actual misappropriation or conversion? Nonpayment alone does not always prove estafa. The fact pattern must show more than an unpaid obligation.
Was there demand? In many estafa-by-misappropriation fact patterns, demand is evidentiary, not always absolutely indispensable in every formulation, but it is often important because refusal or failure to account after demand can support an inference of conversion.
Is the issue actually a debt? A pure debtor-creditor relationship is not automatically estafa.
What was the deceit, if any? If the letter invokes estafa through fraud, it should identify the false representation, when it was made, and how it caused damage.

E. Estafa versus theft

A rough practical distinction:

Theft / qualified theft focuses on taking property belonging to another.
Estafa often focuses on misappropriating property or money that was first received lawfully, or obtaining it through deceit.

A threatening letter that alleges both may or may not be correct. Sometimes the facts can support alternative theories. Sometimes the writer simply included both to maximize fear.

F. Common defense themes

Depending on the case:

no deceit;
no conversion;
no juridical possession of the kind alleged;
no entrustment for a specific purpose;
the transaction is a civil debt or failed business arrangement;
the amount remains subject to reconciliation;
there was no damage, or the amount is overstated;
records are incomplete or manipulated;
settlement discussions are being reframed as admissions.

VII. Qualified theft vs estafa: why the distinction matters

A sophisticated assessment asks not only whether the accusation sounds bad, but whether the facts fit the correct offense.

Questions that often expose weakness

Did the accused ever have lawful possession or only physical access?
Was money received for the complainant, or was it part of a broader commercial obligation?
Is the complainant alleging taking without consent, or receipt with consent followed by conversion?
Is the claim based on missing inventory, unremitted collections, fake receipts, fabricated reimbursements, unauthorized transfers, or unreturned equipment?

These factual differences matter. Overly broad letters often blur them.

VIII. Can a demand letter itself create criminal liability?

No. A demand letter does not create criminal liability. It may:

document demand;
trigger a deadline;
provide a basis for claiming refusal to account or return;
warn of impending filing.

Actual criminal liability still depends on:

the legal elements of the offense;
the evidence;
the prosecutor’s evaluation during preliminary investigation;
later judicial determination if a case is filed.

IX. How criminal cases usually proceed in the Philippines after the letter

A typical sequence may look like this:

Demand letter sent.
Recipient replies, ignores, negotiates, or disputes.
Complainant files a criminal complaint-affidavit before the prosecutor’s office.
Respondent is required to submit a counter-affidavit and supporting evidence.
There may be a preliminary investigation or clarificatory hearing depending on the case posture.
Prosecutor determines whether probable cause exists.
If probable cause is found, an information may be filed in court.
Criminal proceedings continue in court.

So the demand letter should be treated seriously because it may be laying groundwork for the complaint-affidavit.

X. Assessing the evidence behind the accusations

The real question is not “Can they accuse me?” but “What can they prove?”

A. Documentary proof

Look for:

signed acknowledgment receipts;
cash accountability forms;
official receipts and duplicate receipts;
collection lists;
remittance slips;
liquidation reports;
inventory counts and variance reports;
audit findings;
bank transfer records;
CCTV logs;
computer access logs;
turnover records;
disbursement vouchers;
payroll and reimbursement records.

B. Chain of custody and access

Ask:

who counted the money?
who handled the inventory?
who approved releases?
who reconciled the books?
who had passwords, keys, vault access, or admin access?
were there shared credentials?
were there turnover gaps?

C. Witnesses

Potential witnesses may include:

auditors;
supervisors;
co-custodians;
HR staff;
branch officers;
clients;
payors or payees.

D. Weak-evidence indicators

no audit report;
no itemized shortage;
no proof of entrustment;
no receipt signed by the accused;
inconsistent amounts across documents;
allegations based only on rumor or “loss of confidence”;
reliance on resignation, silence, or delay as if that alone proves guilt.

XI. Demand letters in employment settings: a major Philippine pattern

Many Philippine demand letters of this kind arise from employment disputes.

A. Why this matters

In an employment context, facts may overlap with:

administrative discipline by the employer;
termination for just cause;
final pay and clearance disputes;
criminal complaint;
sometimes even a labor case if illegal dismissal or unpaid wages are involved.

B. Important caution

An employer’s accusation of dishonesty, fraud, or theft does not automatically settle the criminal question. Internal company findings are not the same as a criminal adjudication.

C. Watch for procedural overlap

You may receive:

notice to explain;
preventive suspension notice;
administrative hearing notice;
demand letter;
release and quitclaim forms;
repayment proposal forms.

Each of these has different legal consequences. Do not treat them as interchangeable.

D. Loss of trust and confidence is not the same as criminal guilt

In Philippine employment law, loss of trust and confidence may be asserted as a just cause for dismissal in some positions, but that is analytically distinct from proving qualified theft or estafa beyond the administrative or prosecutorial threshold.

XII. Business, agency, and collections disputes: when criminal language masks a civil claim

A frequent misuse of threatening letters is to repackage a civil money claim as estafa or theft.

Situations requiring caution

unpaid loans;
failed investments;
commission disputes;
breached sales agreements;
delayed remittances where the accounting is not yet reconciled;
corporate officer disputes over disbursements;
informal cash advances;
business partner disputes.

Not every unreturned amount is criminal. The key question is whether the facts really show:

unlawful taking,
fraudulent inducement,
or misappropriation of entrusted property, rather than just breach of contract, bad bookkeeping, or insolvency.

XIII. The threat of PRC revocation: how to assess it realistically

A. What it means

A threat to seek PRC revocation, suspension, or administrative sanctions is different from threatening criminal prosecution. It refers to the possibility that a complaint may be filed before the professional regulatory body or under the governing law of the profession.

B. Important point

A PRC license is generally not revoked merely because someone sent a demand letter or because a private complainant declared that the professional is guilty.

Usually, there must be:

a proper complaint;
jurisdiction over the professional and subject matter;
notice and opportunity to answer;
a finding based on applicable professional law, code of ethics, or administrative rules.

C. What kinds of conduct may expose a professional to PRC discipline

This depends on the profession, but commonly includes:

dishonesty;
fraud;
deceit;
immoral or unprofessional conduct;
gross negligence;
unethical handling of client funds or documents;
convictions or acts involving moral turpitude, depending on the law and the profession;
violations of the profession’s code of ethics or special regulatory statute.

D. Why this threat is often overstated

Demand letters often speak as if PRC revocation is automatic after accusation or after failure to pay. That is usually wrong.

A complainant generally still needs to pursue the proper administrative route, and the case must fit the grounds recognized under the law governing that profession.

E. Key assessment questions

What is the recipient’s profession? Accountant, engineer, teacher, nurse, doctor, architect, real estate service professional, etc.
What exact act is being tied to the profession? A personal debt dispute may not automatically become a PRC issue, though fraud-related conduct can have professional implications.
Is the alleged misconduct connected to professional practice? Connection strengthens the threat, but some professions also regulate broader conduct involving dishonesty.
What is the specific legal basis for revocation or suspension? A strong letter should identify the professional law, ethical code, or administrative rule.
Is there already a criminal conviction? In some settings, conviction can significantly affect professional standing. Mere allegation is different from conviction.

F. How to react

Treat a PRC threat seriously, but do not assume:

immediate suspension,
automatic revocation,
automatic publication,
or automatic loss of the right to practice.

Administrative due process still matters.

XIV. When the demand letter may itself be abusive or legally improper

Not every threatening letter is unlawful, but some cross the line.

Potential issues can arise when the sender:

uses plainly false accusations with reckless disregard for the facts;
circulates the accusations beyond those with legitimate interest;
uses criminal allegations purely to extort or harass;
demands payment unrelated to the actual claim;
threatens shame campaigns or public exposure;
pressures the recipient to sign false admissions.

That said, Philippine law generally gives room for forceful demand letters made in good faith by parties asserting perceived rights. The fact that a letter is aggressive does not make it illegal by itself.

XV. Should you reply?

Often yes, but carefully.

Reasons to reply

to deny false allegations promptly;
to preserve your version of events;
to request documents and particulars;
to avoid an inference that you ignored demand;
to position yourself before a possible complaint-affidavit.

Reasons not to reply personally

you might make harmful admissions;
you may misunderstand the legal issues;
emotional language can be used against you.

Best practice

A reply through counsel is often safest where the letter alleges criminal conduct.

What a careful reply may do

acknowledge receipt;
deny unsupported allegations;
demand particulars and supporting documents;
state the correct factual timeline;
preserve defenses;
reject coercive settlement language;
reserve legal remedies.

A reply should rarely contain:

casual admissions;
guessed amounts;
apologies implying culpability;
explanations inconsistent with documents;
attacks unsupported by evidence.

XVI. Should you pay to make the problem go away?

Payment is not a purely legal question; it is also strategic.

Things to understand

Payment may be treated as compromise, restitution, or partial settlement.
In some contexts it may reduce hostility, but it can also be spun as an implied admission if badly documented.
Payment does not automatically erase criminal exposure unless the matter is resolved in a way legally recognized and the complainant actually desists or the facts no longer support prosecution.
A desistance affidavit is not always controlling on the prosecutor or court.

If payment or settlement is considered

The documentation matters:

what exactly is being paid?
is liability admitted or denied?
is the payment full or partial?
what claims are being waived?
will criminal, civil, administrative, and employment aspects all be covered?
who signs?
is corporate authority shown if the complainant is a company?

Do not sign vague “confession plus payment undertaking” documents casually.

XVII. The role of demand in estafa and other disputes

A common misconception is that “without demand, there is no case.” That is too simplistic.

More accurate practical guidance:

In many misappropriation-type estafa cases, demand can be important to show failure to account or return, and thus support an inference of conversion.
But the significance of demand depends on the exact theory and facts.
In theft-type accusations, criminality does not depend in the same way on prior demand.

So when the letter emphasizes that this is a “final demand,” that may be legally meaningful, but not always decisive.

XVIII. How to assess the amount being claimed

Never assume the amount in the letter is correct.

Check:

whether the amount is gross or net of offsets;
whether shortages were double-counted;
whether prior remittances were omitted;
whether inventory was priced correctly;
whether there are duplicate entries;
whether company policies actually make the recipient personally accountable for the full amount;
whether the computation includes penalties, interest, attorney’s fees, or “investigation expenses” without legal basis.

In criminal cases, the amount can matter for penalty exposure and credibility. In civil or settlement discussions, it obviously matters for valuation.

XIX. The importance of possession, custody, and accountability

In many Philippine disputes, the entire case turns on what kind of possession the accused had.

Ask:

Was it mere physical handling?
Was there independent authority or juridical possession?
Was the money part of company operations or entrusted separately?
Was the property ever actually received by the accused?
Is there proof of personal appropriation, or only failure of documentation?

These distinctions often separate:

theft from estafa,
crime from labor offense,
and criminal complaint from weak collection tactic.

XX. Internal investigations and audit reports

If the letter cites an audit, request or review:

who conducted it;
what period it covered;
whether the methodology was sound;
whether the accused was allowed to explain;
whether raw records are attached;
whether the findings are final or preliminary;
whether the audit identifies actual missing property or only unreconciled transactions.

An audit can be powerful evidence, but it is not beyond challenge.

XXI. Parallel exposure: criminal, civil, administrative, and labor

A single factual situation can generate multiple tracks at once.

1. Criminal

Qualified theft, estafa, falsification, or related accusations.

2. Civil

Recovery of money, damages, accounting, return of property.

3. Administrative / PRC

Ethics complaint, professional misconduct, dishonesty.

4. Employment / labor

Dismissal, clearance, benefits, wage claims, illegal deduction issues.

A threatening letter often implies all four, but the evidence for each track may differ.

XXII. How prosecutors typically look at these cases

Without turning this into a procedural manual, a prosecutor usually asks whether there is probable cause, not yet proof beyond reasonable doubt.

That means:

weak but coherent documentary evidence can still lead to filing;
silence or a poor counter-affidavit can be costly;
contradictions in the respondent’s explanation can hurt badly;
a clean documentary defense early on can matter a lot.

So the question is not only “Can they win at trial?” but also “Can they get past preliminary investigation?”

XXIII. Warning signs that the accusations may be stronger than they first appear

Take the letter very seriously if it is backed by:

signed acknowledgment receipts;
written trust receipts, liquidation duties, or remittance obligations;
clear audit trails;
exclusive custody evidence;
CCTV or access logs;
falsified supporting documents;
repeated demand and refusal to account;
admissions in chat, email, or text;
witness statements from disinterested parties;
altered books, forged signatures, or fabricated vouchers.

The presence of these facts can convert what looks like a bluff into a dangerous case.

XXIV. Warning signs that the letter may be weak or inflated

The accusations may be overstated where:

no specific transaction is identified;
the property is not described clearly;
the amount keeps changing;
the sender confuses debt with estafa;
the sender alleges theft even though lawful possession is obvious and documented;
the sender alleges PRC revocation without citing any professional ground;
no audit or accounting support is provided;
several people shared access;
the demand seems designed only to force payment of a disputed account.

Weak does not mean harmless, but it changes strategy.

XXV. How PRC-related risk should be analyzed profession by profession

While the basic principle is the same, the details differ depending on the regulated profession.

Example risk factors across professions

Accounting / bookkeeping roles: client funds, falsified records, misstatements, unauthorized entries.
Engineering / architecture: document falsification, unethical certifications, misuse of entrusted project funds.
Medical / nursing / allied health: mishandling of patient funds or records, dishonesty affecting practice.
Teaching / education: fraud, dishonesty, misconduct tied to fitness to practice.
Real estate service professions: client funds, trust money, commission disputes involving misrepresentation.

The stronger the connection between the alleged dishonesty and the professional’s regulated functions, the more credible the administrative threat becomes.

XXVI. Do not confuse accusation with moral turpitude automatically

Threatening letters often use phrases like “crime involving moral turpitude” as though they automatically destroy a professional career.

In reality:

whether an offense involves moral turpitude can be legally significant in some contexts,
but the analysis can be nuanced,
and allegations alone do not equal a final legal finding.

A letter that jumps from accusation to automatic professional ruin is usually overstating things.

XXVII. How to evaluate deadlines in the letter

Deadlines like “within 24 hours” or “within 48 hours” are common pressure tactics.

Assess:

Is the deadline contract-based?
Is immediate return of a specific item actually feasible?
Is the sender trying to force a confession?
Is the deadline tied to a scheduled filing date?

A short deadline does not remove your right to answer carefully.

XXVIII. Should you ignore the letter?

Usually that is risky.

Ignoring may:

accelerate filing of a complaint;
allow the sender to say you refused to explain or account;
waste a chance to present documents early.

That said, not every letter requires a long substantive response. The response may simply preserve rights and state that detailed allegations and documents are requested.

XXIX. Common mistakes recipients make

admitting facts loosely in chat;
negotiating directly without counsel;
signing promissory notes that double as confessions;
returning partial funds without clear settlement terms;
deleting messages;
contacting witnesses to “fix” statements;
replying emotionally and inconsistently;
assuming HR, a company auditor, or a private lawyer already “proved” the criminal case;
dismissing the PRC threat without checking whether the conduct could be framed as professional dishonesty.

XXX. Common mistakes complainants make

From the other side, complainants also weaken their own position by:

mislabeling the offense;
relying on suspicion instead of proof;
failing to document demand;
inflating the amount claimed;
asserting PRC sanctions without jurisdictional basis;
making defamatory public accusations;
confusing labor infractions with criminal acts;
treating every unpaid obligation as estafa.

These flaws matter if you are the recipient evaluating the letter.

XXXI. How to structure a legal assessment of the letter

A disciplined review can be organized this way:

1. Identify the factual nucleus

What exactly happened?

2. Match facts to each offense separately

qualified theft?
estafa?
PRC administrative exposure?

3. Check proof for each element

Not general suspicion—actual proof.

4. Separate civil from criminal theories

Debt, accounting disputes, and breach of contract are not automatically crimes.

5. Evaluate procedural posture

Is this just demand, or is a complaint-affidavit likely imminent?

6. Assess exposure beyond criminal law

Employment status, administrative liability, licensing consequences, reputation risk.

7. Determine response strategy

Deny, explain, reconcile, settle, or prepare for formal defense.

XXXII. A practical issue-spotting matrix

Use these questions:

For qualified theft

What property?
Who owned it?
Was it taken without consent?
Who had access?
Was there intent to gain?
What makes it “qualified”?

For estafa

How was property received?
Was there entrustment?
What was the exact purpose?
Was there conversion or deceit?
What is the proof of damage?
Was there demand and failure to account?

For PRC revocation or suspension

What profession?
What regulatory basis?
What professional duty was violated?
Is the conduct tied to practice or fitness?
Is there only an accusation, or already an administrative case?

XXXIII. When the best defense is factual reconstruction

In many Philippine white-collar or workplace-related accusations, the decisive defense is not a dramatic legal theory but a clean factual reconstruction:

cash count sheets;
remittance timestamps;
access records;
approval chains;
proof of handover;
client acknowledgments;
messages showing instructions from superiors;
evidence that another person handled the questioned transaction.

The side with the cleaner timeline often has the advantage.

XXXIV. Settlement, desistance, and practical reality

In practice, many disputes of this kind end in:

repayment arrangements;
restitution without admission;
withdrawal of demand;
desistance by the complainant;
resignation or separation arrangements;
internal administrative disposition.

But the legal system does not treat every settlement as erasing criminality. Much depends on:

the nature of the offense;
the evidence;
whether the complainant actually follows through;
whether prosecutors still find probable cause.

XXXV. The central mindset: do not panic, but do not minimize

A threatening legal demand letter alleging qualified theft, estafa, and PRC revocation should neither be dismissed as mere bluff nor accepted as proof of guilt.

The correct Philippine-law approach is to ask:

What exactly are the facts?
Which legal theory actually fits those facts?
What evidence exists for each element?
Is the matter criminal, civil, administrative, labor-related, or some combination?
Is the PRC threat legally grounded or just intimidation?

Most importantly, the legal strength of the letter does not depend on how frightening the language is. It depends on whether the sender can prove:

unlawful taking,
fraudulent inducement,
misappropriation of entrusted property,
or professional misconduct under the applicable regulatory framework.

That is the difference between a letter designed to scare and a claim that can actually survive formal scrutiny.

Bottom line

In the Philippine context, a demand letter threatening qualified theft, estafa, and PRC revocation should be assessed on three separate tracks: criminal liability for taking, criminal liability for fraud or conversion, and administrative exposure as a professional. Many letters overstate one or more of these. The right response is a methodical evidence-based analysis, not panic, not silence, and not casual admission. A well-documented defense can expose weak accusations; a poorly handled response can strengthen even an imperfect complaint.