If you suspect an employee stole money, inventory, company property, or customer payments, the first question is usually not “How do I punish this person?” but “How do I file the case properly so it will not be dismissed?” In the Philippines, employee theft can become qualified theft when the employee used a special position of trust to take property without consent. This article explains what qualified theft means, when it applies to employees, what evidence you need, where to file the complaint, what happens at the prosecutor’s office, and the common mistakes that can weaken an otherwise valid case.

What is qualified theft in the Philippines?

Qualified theft is a more serious form of theft under the Revised Penal Code. Basic theft happens when a person takes another person’s personal property, with intent to gain, without the owner’s consent, and without violence, intimidation, or force upon things. Article 308 of the Revised Penal Code defines theft in this way. (Lawphil)

Theft becomes qualified theft under Article 310 when it is committed under special circumstances, including:

by a domestic servant;
with grave abuse of confidence;
when the property stolen is a motor vehicle, mail matter, or large cattle;
when the property consists of coconuts taken from a plantation, or fish taken from a fishpond or fishery;
when property is taken on the occasion of fire, earthquake, typhoon, volcanic eruption, calamity, vehicular accident, or civil disturbance.

For employee cases, the most common ground is grave abuse of confidence. Article 310, as amended by Batas Pambansa Blg. 71, imposes a penalty two degrees higher than the penalty for ordinary theft under Article 309. (Supreme Court E-Library)

In simple terms: not every stealing by an employee is automatically qualified theft. The employer must show that the employee was given a position of trust connected to the property, and that the employee used that trust to commit the taking.

Qualified theft vs. simple theft vs. estafa

Many employers call every missing-money case “qualified theft,” but prosecutors look at the facts carefully. A complaint may be dismissed or downgraded if the wrong offense is alleged.

Situation	Possible case	Practical explanation
Cashier pockets money from the cash register	Qualified theft or theft	The cashier usually has custody of the money because of the job. If the position involves special trust, qualified theft may apply.
Sales agent receives collections from customers and does not remit them	Estafa or qualified theft, depending on facts	If the employee had juridical possession or received money under an obligation to account, estafa may be considered. If the employee only had material custody, theft may apply.
Warehouse employee removes inventory using access given by the company	Qualified theft or theft	Stronger qualified theft case if the employee was entrusted with stock, access keys, inventory control, or release authority.
Employee refuses to return a laptop after resignation	Theft, qualified theft, civil action, or labor dispute depending on intent	Non-return alone is not always theft. Evidence of intent to gain and unlawful taking matters.
Bookkeeper manipulates records and diverts company funds	Qualified theft, estafa, falsification, or cybercrime-related charges	The exact charge depends on how the funds were obtained, what documents were falsified, and whether computer systems were used.

The distinction between theft and estafa often turns on possession. In broad terms, theft usually involves unlawful taking from the owner’s possession, while estafa often involves misappropriation of property already received in trust, on commission, for administration, or under an obligation to return or deliver.

Legal basis for filing a qualified theft case against an employee

The main legal bases are:

Article 308, Revised Penal Code — defines theft.
Article 309, Revised Penal Code, as amended by Republic Act No. 10951 (2017) — sets the penalties for theft depending on the value of the property stolen. RA 10951 updated the value thresholds, such as over ₱20,000 but not over ₱600,000, over ₱600,000 but not over ₱1,200,000, and higher brackets. (Supreme Court E-Library)
Article 310, Revised Penal Code, as amended — provides when theft becomes qualified theft and raises the penalty by two degrees. (Supreme Court E-Library)
Rule 110 and Rule 112 of the Rules of Criminal Procedure and the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings — govern how criminal complaints are evaluated by prosecutors.
Article 297 of the Labor Code — separately allows termination for just causes such as serious misconduct, fraud, willful breach of trust, and commission of a crime against the employer or the employer’s representatives. (Labor Law PH Library)

The criminal case and the labor case are related but separate. Filing a qualified theft complaint does not automatically mean the employee is validly dismissed. The employer must still comply with labor due process if termination is pursued.

Elements you need to prove

To file a strong qualified theft complaint against an employee, prepare evidence for each element:

There was taking of personal property. This may involve cash, inventory, equipment, documents with value, digital funds, company-issued devices, or other movable property.
The property belonged to another. The complainant must prove ownership or lawful possession. For a company, this may require receipts, inventory records, asset registers, sales reports, accounting records, or customer payment records.
The taking was done with intent to gain. “Gain” does not always mean cash profit. It may include use, benefit, disposal, concealment, or appropriation.
The taking was without the owner’s consent.
The taking was without violence, intimidation, or force upon things. If there was force upon things or violence, robbery may be considered instead.
There was a qualifying circumstance. In employee cases, this usually means grave abuse of confidence. The complaint should explain why the employee’s position created a high degree of trust, and how that trust made the taking possible.

What “grave abuse of confidence” means in employee theft

The phrase sounds technical, but the idea is practical. The employee must have been trusted in a way that gave them special access, custody, control, or responsibility over the property.

Good facts for grave abuse of confidence may include:

the employee was a cashier, vault custodian, accounting officer, collection agent, warehouseman, purchaser, store supervisor, branch manager, bookkeeper, payroll officer, or inventory custodian;
the employee had access to keys, passwords, POS terminals, bank portals, GCash or Maya business accounts, vaults, stock rooms, delivery documents, or official receipts;
the employee’s job required handling company funds, customer payments, stock releases, or financial records;
the taking was concealed through false entries, fake receipts, altered inventory, voided transactions, deleted records, or manipulated reports.

Weak facts may include:

the employee was merely present at the workplace;
several people had equal access to the missing property;
the only evidence is suspicion or office gossip;
the employee had no special duty over the property;
the employer cannot prove what was missing, when it went missing, or who took it.

A common mistake is writing only: “Respondent is our employee, so this is qualified theft.” That is usually not enough. The affidavit should explain the specific trust relationship and how the employee abused it.

Step-by-step guide: how to file a qualified theft case against an employee

1. Secure the evidence immediately

Before confronting the employee, preserve evidence. Do not rely on memory or verbal reports.

Secure:

CCTV footage, including backup copies;
POS logs, void reports, discount records, and cash drawer reports;
inventory count sheets and variance reports;
delivery receipts, sales invoices, official receipts, collection receipts;
bank statements, e-wallet transaction histories, online banking logs;
access logs, login records, emails, chats, and internal approvals;
employment contract, job description, appointment papers, and company policies;
incident reports from supervisors or auditors;
sworn statements from witnesses.

For digital evidence, avoid editing the original file. Save copies with date stamps, file names, device information, screenshots, and export logs where available. If CCTV automatically overwrites after a few days, copy it immediately.

2. Conduct a careful internal investigation

Interview witnesses separately. Compare documents. Reconcile cash, sales, and inventory. Identify the exact amount or property involved.

Avoid these risky actions:

forcing the employee to confess;
detaining the employee in the office;
threatening physical harm or public humiliation;
searching bags, phones, or lockers without a lawful basis or consent;
posting the accusation on social media;
making unauthorized salary deductions without proper legal basis.

A forced confession can backfire. It may create labor, civil, or criminal exposure for the employer and may weaken the criminal complaint.

3. Decide who will file the complaint

The complainant may be:

the individual owner;
the corporate officer authorized by the company;
the branch manager or officer with a special power of attorney;
an authorized representative supported by a board resolution or secretary’s certificate.

For corporations, attach proof of authority. Prosecutors often require a Secretary’s Certificate, board resolution, or notarized authorization showing that the person signing the complaint-affidavit can represent the company.

For foreign owners or officers abroad, affidavits and special powers of attorney may need consular notarization or apostille, depending on where they are executed. Philippine embassies and consulates can notarize private documents such as affidavits and special powers of attorney for use in the Philippines. (Philippine Embassy)

4. Prepare the complaint-affidavit

The complaint-affidavit is the core document. It is a sworn written statement explaining what happened and why the respondent should be charged.

A strong complaint-affidavit should include:

full name and address of the complainant;
full name and last known address of the employee;
employee’s position, duties, and period of employment;
description of the property stolen;
value of the property and how the value was computed;
date, time, and place of the taking;
how the taking was discovered;
why the employee had access, custody, or trust;
specific acts showing intent to gain;
list of witnesses and attached evidence;
request that the respondent be charged with qualified theft or other proper offense.

Use clear facts, not conclusions. Instead of writing “Respondent stole company money,” explain:

“Respondent was assigned as cashier for the 2:00 p.m. to 10:00 p.m. shift. POS report No. 1482 showed cash sales of ₱86,450. Respondent remitted only ₱61,450. CCTV footage at 10:18 p.m. shows respondent removing cash from the cash drawer and placing it inside her personal pouch. The shortage was confirmed in the cash count sheet signed by the supervisor and auditor.”

5. Attach supporting affidavits and documents

Each witness with personal knowledge should execute a sworn affidavit. Avoid one affidavit that simply repeats what everyone heard from someone else.

Useful witness affidavits may come from:

the auditor who found the shortage;
the supervisor who counted the cash;
the IT officer who extracted logs;
the inventory custodian who conducted stock count;
the customer who paid the employee;
the HR officer who can prove the employee’s position and duties.

The DOJ’s listed documentary requirements for preliminary investigation include an Investigation Data Form and complaint-affidavit or sworn statement, with supporting documents. (Department of Justice)

6. File with the proper prosecutor’s office

File the complaint with the Office of the City Prosecutor or Office of the Provincial Prosecutor where the offense was committed. Venue is important. If the taking happened in Quezon City, the complaint is usually filed with the Quezon City Prosecutor. If it happened in Cebu City, file there.

For online transfers, branch transactions, or multi-location schemes, venue can be more complicated. The complaint should explain where the taking, receipt, access, or damage occurred.

A police blotter is not the same as filing a criminal case. A blotter may help document the incident, but the criminal complaint must still be filed with the prosecutor or referred properly through law enforcement.

7. Attend prosecutor proceedings

After filing, the prosecutor’s office may evaluate the complaint, require additional documents, or issue a subpoena to the respondent. The respondent is usually given the opportunity to file a counter-affidavit.

Under the 2024 DOJ-NPS framework, prosecutors apply the standard of prima facie evidence with reasonable certainty of conviction in preliminary investigations and inquests. The Supreme Court upheld the validity of the DOJ rules and recognized preliminary investigation as an executive function handled by prosecutors.

This means the complaint should not merely show suspicion. It should present evidence that is admissible, credible, and capable of proving the elements of the offense if the case reaches trial.

8. Wait for the prosecutor’s resolution

The prosecutor may:

dismiss the complaint;
require additional evidence;
find basis for a different offense, such as simple theft or estafa;
file an Information in court for qualified theft.

An Information is the formal criminal charge filed in court in the name of the People of the Philippines. Once the case is filed in court, the judge evaluates whether to issue a warrant of arrest or summons, and the case proceeds to arraignment, pre-trial, and trial.

9. Handle the labor side separately

If the employee is still employed, the company should separately comply with labor due process:

issue a first written notice or notice to explain;
give the employee a meaningful opportunity to respond and be heard;
evaluate the evidence fairly;
issue a final written decision if termination is imposed.

A criminal complaint is not a substitute for the two-notice requirement. Even if the theft evidence is strong, mishandling the dismissal can expose the company to an illegal dismissal case.

Required documents checklist

Document	Why it matters
Complaint-affidavit	Main sworn statement of the complainant
Witness affidavits	Supports facts from people with personal knowledge
Investigation Data Form	Common DOJ/NPS filing requirement
Proof of identity of complainant	Required for notarization and filing
Proof of authority to represent company	Needed if complainant is a corporation or business
Employment contract or HR records	Shows employee’s position and duties
Job description or company policy	Helps prove trust, custody, and accountability
Audit report or inventory report	Shows shortage or missing property
Receipts, invoices, ledgers, bank records	Proves ownership, value, and transactions
CCTV, screenshots, access logs	Supports identification and taking
Demand letter, if any	Helpful in some fact patterns, but not always required
Notarized SPA or apostilled/consularized documents	Needed when the owner or authorized signatory is abroad

Fees, timelines, and practical expectations

Stage	Typical practical timeline	Notes
Evidence gathering and internal audit	A few days to several weeks	Longer for inventory-heavy or multi-branch cases
Preparation of affidavits	1–3 weeks	Depends on witnesses, notarization, and document retrieval
Filing at prosecutor’s office	Same day if complete	Incomplete complaints may be delayed or returned for compliance
Prosecutor evaluation and subpoenas	Several weeks to a few months	Depends on docket load and service of subpoena
Preliminary investigation resolution	Often 2–6 months, sometimes longer	Complex cases, many respondents, or missing documents cause delays
Court proceedings after filing of Information	1–3 years or more	Depends on court congestion, witnesses, plea discussions, and postponements

Government legal fees for criminal complaints are usually modest, but actual expenses may include notarization, certified true copies, printing, courier service, technical extraction of CCTV or logs, translations, apostille or consular fees, and professional fees for audit or legal assistance.

Common mistakes that weaken qualified theft cases

Filing too early with incomplete evidence

A rushed complaint may fail to prove the amount stolen, the employee’s access, or the qualifying circumstance. If the complaint is dismissed, refiling may be harder unless there is new or better evidence.

Treating “missing property” as proof of theft

A shortage is not always theft. It may be caused by encoding errors, spoilage, wrong deliveries, unrecorded returns, system bugs, or poor controls. The complaint should connect the missing property to the respondent’s act.

Failing to prove grave abuse of confidence

Employment alone is not enough. Show why the employee was trusted with the property and how the trust was abused.

Confusing qualified theft with estafa

If the employee received money under an obligation to remit or return it, estafa may be considered. If the employee merely had physical custody and took it without authority, theft may be more appropriate. The prosecutor may determine the proper charge based on the facts.

Using coerced admissions

A confession obtained through threats, detention, intimidation, or humiliation can create serious problems. Voluntary written explanations are safer, especially when obtained through a proper administrative process.

Ignoring labor due process

A company may have a valid reason to dismiss but still lose a labor case because it failed to issue proper notices or give the employee a chance to respond.

Assuming settlement automatically ends the case

Qualified theft is a public offense. Returning the money or signing a settlement may affect civil liability or the complainant’s participation, but it does not automatically erase criminal liability once the State proceeds with prosecution.

What if the employee returns the money?

Return of the money does not automatically erase the crime if the elements of qualified theft already existed. It may be relevant to civil liability, settlement, mitigation, or practical case strategy, but the prosecutor can still proceed if the evidence supports the charge.

If the employer accepts payment, document it carefully:

issue an acknowledgment stating what the payment covers;
avoid language that falsely states no theft happened if the company still intends to proceed;
clarify whether civil claims are settled;
avoid private agreements that require the employer to lie to investigators, prosecutors, or the court.

What if the employee is abroad or has left the Philippines?

A complaint may still be filed if the offense was committed in the Philippines and evidence is available. Practical issues include locating the respondent, serving subpoenas, and later enforcing court processes.

If the complainant or key witness is abroad, their affidavit may need:

notarization before a Philippine Embassy or Consulate; or
notarization in the foreign country followed by apostille or authentication, depending on the country and document type;
certified English translation if the document is in another language.

Foreign business owners should also prepare authority documents proving who may represent the company in the Philippines.

Can an employer recover the stolen money through the criminal case?

Yes, the civil aspect is usually included in the criminal case unless waived, reserved, or separately filed before the criminal action. Rule 111 generally provides that when a criminal action is instituted, the civil action for recovery of civil liability is deemed instituted with it unless the offended party waives it, reserves the right to file separately, or has already filed the civil action. (Lawphil)

In practice, the employer should state the amount of loss clearly and attach proof. If the amount is uncertain, the prosecutor or court may require better documentation.

Frequently Asked Questions

Is a police blotter enough to file a qualified theft case?

No. A police blotter only records that an incident was reported. To pursue the case, you generally need a complaint-affidavit and supporting evidence filed with the proper prosecutor’s office or properly referred by law enforcement.

Do I need CCTV footage to file qualified theft against an employee?

CCTV is helpful but not always required. A case may be supported by audit reports, transaction logs, receipts, witness affidavits, inventory records, admissions, access logs, and other documents. The key is whether the evidence proves the elements of the offense.

Can I file qualified theft if the employee already resigned?

Yes. Resignation does not erase criminal liability if the theft was committed during employment. You still need evidence showing the taking, value, lack of consent, intent to gain, and grave abuse of confidence.

Is demand letter required before filing qualified theft?

Not always. Theft does not generally require a prior demand. However, a demand letter can be useful in cases involving failure to return company property, unremitted collections, or situations where intent to gain may be disputed.

Can I deduct the stolen amount from the employee’s salary or final pay?

Be careful. Unauthorized deductions can create labor problems. If the employee gives a clear written authorization or there is a lawful basis under labor rules, deduction may be possible, but unilateral deductions are risky. Recovery can also be pursued through the civil aspect of the criminal case.

What if the employee says it was just a loan or cash advance?

Then documentation becomes critical. The employer should show company policies, cash handling rules, absence of approval, false entries, concealment, or other facts proving that the taking was unauthorized and done with intent to gain.

Can a company file the case, or must the owner personally file?

A company can file through an authorized representative. The representative should have proof of authority, such as a board resolution, Secretary’s Certificate, SPA, or written authorization, depending on the business structure.

How serious is qualified theft compared with ordinary theft?

Qualified theft is much more serious because Article 310 raises the penalty by two degrees from the penalty for ordinary theft. The exact penalty depends on the value of the property and the applicable provisions of Article 309, as amended by RA 10951.

Can the employee be arrested immediately?

Usually, filing a complaint does not mean immediate arrest. If there is no valid warrantless arrest situation, the case normally goes through the prosecutor. If the prosecutor files an Information in court, the judge determines whether a warrant or summons should issue. Bail depends on the charge, penalty, and court determination.

Can a foreigner file a qualified theft complaint in the Philippines?

Yes, if the foreigner or foreign-owned company is the offended party or has lawful authority to complain. The practical requirements are proof of identity, proof of ownership or loss, and properly notarized, consularized, or apostilled authority documents if the complainant or signatory is abroad.

Key Takeaways

Qualified theft is not automatic just because the suspect is an employee. The complaint must show grave abuse of confidence or another qualifying circumstance.
The strongest cases are built on documents, audit trails, CCTV, witness affidavits, and proof of the employee’s entrusted duties.
File the complaint with the proper city or provincial prosecutor where the offense was committed.
A police blotter helps document the incident but does not replace a prosecutor-level criminal complaint.
The criminal case is separate from the labor process; employers must still observe notices and hearing requirements before dismissal.
Returning the money or signing a settlement does not automatically erase criminal liability.
For companies and foreign complainants, authority documents, notarized affidavits, and apostille or consular requirements can be just as important as the evidence of theft.