Quick answer

A private employer in the Philippines may investigate suspected employee fraud or falsified records and, when the facts justify it, dismiss the employee for a just cause. But suspicion, an audit variance, a criminal complaint, or the phrase “loss of trust and confidence” is not enough by itself.

A defensible dismissal requires both:

Substantive due process: the employer proves a specific, intentional, work-related dishonest act through substantial evidence and connects it to a just cause under Article 297 of the Labor Code; and
Procedural due process: the employer gives a detailed first written notice, at least five calendar days from receipt to answer, a meaningful opportunity to be heard, and a separate written decision after genuinely considering the defense.

Fraud or falsification does not automatically justify dismissal in every case. An inaccurate entry may result from mistake, unclear instructions, shared credentials, a system problem, or negligence rather than an intent to deceive. The employee’s actual duties, the evidence, company rules, surrounding circumstances, and proportionality of the penalty all matter.

This discussion principally covers private-sector employment. Government personnel, seafarers, and employees covered by collective bargaining agreements or special disciplinary rules may have additional or different procedures.

The governing legal rule

Article 297—formerly Article 282—of the Labor Code allows termination for, among other just causes:

Serious misconduct connected with the employee’s work;
Willful disobedience of a lawful, reasonable, and work-related order;
Gross and habitual neglect of duties;
Fraud or willful breach of the trust reposed in the employee;
Commission of an offense against the employer or specified persons; and
Causes analogous to those listed.

The company handbook may define fraud, dishonesty, tampering, or falsification and prescribe corresponding penalties. It does not, however, replace the Labor Code. For dismissal, the proven conduct must still amount to a lawful just cause, and the employer must observe due process. See the DOLE edition of the Labor Code and Department Order No. 147-15.

When fraud or falsification may justify dismissal

Fraud must involve a real intent to deceive

A willful breach is one committed intentionally, knowingly, and purposely, without a justifiable excuse—not merely carelessly, thoughtlessly, or inadvertently. The act must ordinarily be work-related and indicate that continued employment in the position is no longer reasonably compatible with the trust required.

Possible examples include deliberately manufacturing receipts, changing voucher or invoice numbers to conceal a shortage, creating fictitious transactions, falsifying attendance for an improper benefit, manipulating inventory records, or inventing approvals. Whether any example is dismissible still depends on the evidence and circumstances.

The Supreme Court has cautioned that fraud and dishonesty require a dishonest act reflecting a disposition to deceive, defraud, or betray the employer. A record alteration that truthfully corrected what occurred was not automatically fraud in Intercontinental Broadcasting Corporation v. Guerrero.

“Loss of trust” has specific requirements

Dismissal for loss of trust and confidence generally requires proof that:

The employee held a position of trust and confidence; and
The employee committed a work-related act that justifies the loss of that trust.

Positions of trust commonly include:

Managerial employees whose actual functions involve management or significant discretion; and
Fiduciary rank-and-file employees who regularly handle significant money, property, inventory, accounts, audit functions, or similarly sensitive matters.

The job title is not conclusive. The actual duties, authority, access, and responsibility control. Even for a managerial employee, loss of confidence cannot rest on speculation, an afterthought, or an unsupported assertion. The employer must present substantial evidence of an actual breach. These principles are explained in San Miguel Corporation v. Gomez and Jalit v. Cargo Safeway, Inc..

If the employee does not occupy a position of trust, proven falsification may still fall under serious misconduct, willful disobedience, or another applicable just cause. The employer must identify and prove the correct ground rather than stretch “loss of trust” to cover every employee.

The required proof is substantial evidence

Substantial evidence means relevant evidence that a reasonable mind might accept as adequate to support a conclusion. It is less than proof beyond reasonable doubt, but it is more than accusation, rumor, or suspicion.

The employer bears the burden of proving the legality of a dismissal. Evidence should establish the employee’s identity, participation, intent, and connection to the questioned record—not merely that an irregularity existed.

In Pepsi-Cola Products Philippines, Inc. v. Pacana, the Court upheld dismissal where transaction records and the employee’s admissions substantially showed deliberate falsification used to conceal fraudulent transactions. By contrast, dismissal fails when the employer cannot connect the employee to the alleged act or relies on speculative inferences.

A fair investigation, step by step

1. Protect people, property, and evidence

At the first credible report, the employer should:

Stop ongoing unauthorized transactions or access;
Preserve relevant paper and electronic records before routine deletion or overwriting;
Secure originals and work from documented copies;
Record who collected each item, when, from where, and how it was stored;
Preserve audit trails, access logs, email headers, approval histories, CCTV footage, device or system records, and relevant policies;
Limit the investigation to authorized personnel; and
Avoid announcing guilt to co-workers or outsiders.

Changing passwords, temporarily restricting access, requiring dual approval, or moving custody of funds or records may be appropriate protective measures. These controls should be documented and should not be disguised punishment.

Investigators should not alter original files, use another person’s credentials, obtain data through unauthorized access, or ask employees to destroy or “clean up” records.

2. Conduct a neutral preliminary fact-finding review

The preliminary review should determine whether there is a concrete allegation worth answering. It is not yet the final disciplinary decision.

Identify:

The specific transaction, record, date, amount, account, or document involved;
Who created, approved, modified, transmitted, or benefited from it;
Whether credentials were individual or shared;
The relevant workflow and segregation of duties;
Applicable policies, instructions, contracts, job descriptions, and past practices;
Possible innocent explanations, system errors, or control failures; and
Whether other employees participated or had comparable access.

Interview witnesses separately where practical. Record questions and answers accurately, allow corrections, and distinguish personal knowledge from assumption or hearsay. An audit conclusion is stronger when supported by its underlying documents and methodology.

If the preliminary evidence does not reasonably connect the employee to misconduct, the employer should not issue a charge merely to see whether the employee will confess.

3. Serve a detailed first notice or notice to explain

If there is a sufficient factual basis, the employer should issue a written notice to explain. It should state:

The specific acts or omissions charged;
Relevant dates, transactions, documents, amounts, and circumstances;
The employee’s alleged participation;
The company rule or policy allegedly violated;
The applicable just cause under Article 297;
The possible disciplinary consequence, including dismissal when applicable;
The deadline and method for submitting the explanation; and
How the employee may request a conference or submit supporting evidence.

A vague notice saying only “fraud,” “dishonesty,” “falsification,” or “loss of trust” is inadequate. Charges against multiple employees should identify each employee’s alleged participation rather than impose collective liability.

The employee must receive at least five calendar days from receipt of the notice to prepare an explanation, consult a union officer or lawyer, collect records, and decide on a defense. Five days is a minimum, not necessarily a safe maximum: a reasonable extension may be necessary when the case involves voluminous records, technical evidence, illness, or difficulty obtaining documents.

The notice should be served through a verifiable method. If personal service is unsuccessful, retain proof of attempted service and delivery to the employee’s last known address. The Supreme Court’s detailed notice requirements appear in King of Kings Transport, Inc. v. Mamac.

If the investigation later uncovers a materially different charge, the employer should issue a supplemental notice and provide a fresh, meaningful opportunity to answer it. A dismissal should not rest on an uncharged theory first revealed in the decision.

4. Give a meaningful opportunity to be heard

The employee should be permitted to:

Submit a written explanation and supporting records;
Identify witnesses or evidence that may disprove the charge;
Explain disputed access, shared credentials, approvals, corrections, or work practices;
Challenge the reliability or interpretation of management’s evidence;
Ask for a reasonable conference when clarification is needed; and
Obtain assistance from a representative, union officer, or counsel if desired.

An administrative hearing is not necessarily a courtroom-style trial. A written explanation can constitute a meaningful opportunity to be heard. Under Department Order No. 147-15, however, a formal hearing or conference becomes mandatory when the employee requests one in writing, substantial evidentiary disputes exist, company rules or practices require it, or similar circumstances justify it.

Give advance notice of any conference, identify the subject, keep fair minutes, and allow the employee to respond to material evidence. The investigator or deciding officer should remain open to exoneration or a lesser penalty.

If the employee refuses to receive the notice, fails to answer, or does not attend despite proper notice and adequate opportunity, the employer may decide using the available evidence. Document the service attempts, deadline, nonappearance, and opportunity actually offered. Silence is not a substitute for proof of the charge.

5. Make an evidence-based and proportionate decision

The decision-maker should separately determine:

What facts are established by substantial evidence;
Whether the employee acted intentionally or whether the problem was mistake or negligence;
Whether the conduct is work-related;
Which Article 297 ground, if any, applies;
Whether the position genuinely requires the trust allegedly breached;
Whether company rules were communicated and consistently applied;
Whether dismissal is proportionate to the proven misconduct; and
Whether mitigating or aggravating circumstances materially affect the penalty.

Relevant circumstances may include the employee’s actual role, prior record, length of service, motive, concealment, admission, cooperation, personal benefit, impact on operations, amount involved, and treatment of comparable cases. None should be applied mechanically.

6. Serve a separate written decision

If dismissal is justified, the second written notice should state:

The findings on the charged acts;
The important evidence and defense considered;
Why the explanation was accepted or rejected;
The company rule and Labor Code ground established;
The penalty and its effective date; and
Any lawful instructions for turnover, clearance, and return of company property.

The second notice must be a genuine decision issued after consideration—not a prewritten termination letter presented at the same time as the charge.

If the evidence does not establish the charge, close the case, lift temporary restrictions, restore the employee as appropriate, and correct any personnel record that inaccurately states guilt. If a lesser offense is proven, apply only a lawful and proportionate sanction under the applicable rules.

Preventive suspension is limited

Preventive suspension is not automatic whenever fraud is alleged. It is a temporary protective measure, not a penalty.

It may be imposed when the employee’s continued presence creates a serious and imminent threat to the life or property of the employer or co-workers. In a fraud investigation, access to money, inventory, critical systems, witnesses, or records may support suspension when there is a concrete risk of further loss, tampering, or obstruction. The employer should document that connection.

A preventive suspension generally:

Must not exceed 30 days;
May be without pay when lawfully justified;
Must end with reinstatement to the former or a substantially equivalent position after 30 days; or
May be extended only if the employee receives the wages and benefits due during the extension.

The employee need not refund wages paid during an extension even if ultimately dismissed. An unjustified suspension may result in liability for the withheld salary. An indefinite unpaid suspension can become constructive dismissal. See Lagamayo v. Cullinan Group, Inc..

There is no general statutory number of days for completing every investigation. That does not permit an employer to keep an employee indefinitely in unpaid suspension. If the inquiry cannot be concluded within the lawful suspension period, reinstate the employee or place the employee on paid status while completing it.

Evidence worth preserving

For the employer

Preserve, where relevant and lawfully accessible:

Original vouchers, receipts, invoices, time records, inventory sheets, and approval forms;
System and application audit logs;
User-access records and evidence showing whether credentials were shared;
Emails and messages with complete dates, participants, and attachments;
Bank, remittance, delivery, customer, supplier, or reconciliation records;
CCTV footage and the applicable retention policy;
Job descriptions, authority matrices, control procedures, and policy acknowledgments;
Audit workpapers and explanations of calculations;
Signed or reliably recorded witness statements;
Notices, delivery receipts, employee submissions, minutes, and the written decision; and
Documents showing how comparable cases were handled.

For the employee

Keep lawful copies of:

Every notice, including the envelope, email header, or proof of receipt;
The handbook, code of conduct, collective bargaining agreement, and job description;
Instructions, approvals, corrections, and communications relevant to the questioned record;
Lawfully available logs or screenshots showing access, timing, system errors, or shared processes;
The written explanation and proof that it was submitted;
Requests for documents, extensions, representation, or a conference;
Conference minutes and objections to inaccuracies;
Preventive-suspension and termination notices;
Payslips, schedules, benefits records, and final-pay computations; and
Names of witnesses with first-hand knowledge.

Do not delete or alter records, remove unrelated confidential company data, secretly access systems after authority has been withdrawn, or coach witnesses.

Privacy and confidentiality still apply

An investigation may involve employee, customer, supplier, financial, biometric, or communications data. The Data Privacy Act does not prohibit legitimate workplace investigations, but collection and use must have a lawful basis and follow transparency, legitimate purpose, proportionality, security, and confidentiality requirements.

Employers should:

Collect only data relevant to the defined investigation;
Restrict access to people with a legitimate role;
Avoid circulating accusations or evidence to uninvolved personnel;
Redact unrelated personal information where possible;
Secure transfers to auditors, lawyers, or forensic providers;
Follow lawful retention and disposal rules; and
Coordinate with the data protection officer when sensitive information, extensive monitoring, or a possible personal-data breach is involved.

Employee consent should not automatically be assumed to be the only or correct legal basis. The proper basis depends on the data and purpose. See the Data Privacy Act and its Implementing Rules and Regulations.

The labor case and criminal case are separate

The employer does not need to obtain a criminal conviction before completing a labor investigation. A labor dismissal requires substantial evidence; a criminal conviction requires proof beyond reasonable doubt.

Accordingly:

Filing a police or prosecutor’s complaint does not automatically prove just cause;
A prosecutor’s finding of probable cause does not bind the Labor Arbiter;
Dismissal of the criminal complaint or acquittal does not automatically invalidate a labor dismissal; and
The internal process must still provide the required notices and opportunity to be heard.

The employer should independently evaluate the workplace evidence. Likewise, an employee facing a prosecutor’s subpoena, police inquiry, search, or possible criminal complaint should obtain criminal-defense advice promptly; the risks and response strategy differ from an internal administrative case.

Final pay, deductions, and certificate of employment

An allegation of fraud does not create an unlimited right to confiscate wages or deduct the alleged loss from final pay. Wage deductions require a lawful basis and compliance with the Labor Code and applicable regulations. Restitution, civil recovery, insurance claims, or criminal remedies should be handled through lawful processes rather than an improvised payroll deduction.

Under DOLE Labor Advisory No. 06-20:

Final pay should generally be released within 30 days from separation or termination, unless a more favorable company policy, agreement, or collective bargaining agreement applies; and
A certificate of employment should be issued within three days from the employee’s request.

A certificate of employment ordinarily confirms employment information; it should not be used to publicize an unproven accusation.

Common mistakes that weaken an investigation

Treating an audit exception as automatic proof of fraud;
Deciding to dismiss before asking for the employee’s explanation;
Issuing a vague notice without dates, transactions, conduct, or violated rules;
Giving fewer than five calendar days from actual receipt;
Combining the charge and termination into one predetermined notice;
Denying a written request for a hearing despite material factual disputes;
Refusing reasonable access to information necessary to understand the charge;
Relying on anonymous claims without corroboration;
Ignoring shared credentials, delegated work, system errors, or actual workflows;
Charging several employees without proving each person’s participation;
Using “loss of trust” for an employee whose duties are not genuinely fiduciary;
Relying only on a criminal complaint or prosecutor’s action;
Adding new grounds in the termination notice without a chance to answer;
Keeping the employee indefinitely suspended without pay;
Applying different penalties to comparable employees without a legitimate explanation;
Retaliating against a whistleblower, complainant, union member, or employee who asserted a legal right;
Publicly branding the employee a thief or fraudster before a reliable finding; and
Withholding all final pay or the certificate of employment merely to pressure the employee.

When legal help is urgent

Seek prompt labor or criminal-law advice when:

Money, inventory, customer funds, evidence, or critical systems remain at immediate risk;
Electronic evidence may soon be overwritten or deleted;
The case involves senior management, several participants, retaliation, or a conflict of interest;
A search of personal devices, private accounts, or extensive monitoring is proposed;
A data breach may have occurred;
The employee is asked to resign, sign a confession, or execute a quitclaim immediately;
The five-day response period is about to expire and essential records are unavailable;
Preventive suspension is unsupported or approaching 30 days without reinstatement or pay;
A termination notice has already been received;
Police, NBI, prosecutors, subpoenas, warrants, or criminal charges are involved; or
A Labor Arbiter or NLRC decision has been received.

A Labor Arbiter’s decision is generally appealable to the NLRC within 10 calendar days from receipt, subject to strict procedural requirements. See the 2025 NLRC Rules of Procedure and the NLRC’s official FAQ.

If the dispute cannot be resolved internally

Labor disputes are generally subject to mandatory conciliation-mediation before adjudication, subject to statutory exceptions. A worker or employer may file a Request for Assistance through the DOLE Assistance for Request Management System or at an appropriate DOLE regional or provincial office, NCMB office, or NLRC office.

SEnA generally provides a 30-day conciliation-mediation period. A party may request pre-termination and referral as allowed by law. If the dismissal dispute remains unresolved, it may be referred to the appropriate NLRC Regional Arbitration Branch. See Republic Act No. 10396 and the current revised conciliation-mediation rules.

An illegal-dismissal action generally prescribes in four years from dismissal, while some independent money claims have a shorter three-year period. Waiting is risky because evidence disappears and other procedural deadlines—especially appeals—may be much shorter.

Consequences of getting the process wrong

The result depends on which requirement failed:

Just cause and proper procedure: dismissal may be valid.
Just cause but defective procedure: the dismissal may remain valid, but the employer may owe nominal damages. The Supreme Court has commonly awarded ₱30,000 for a procedurally defective just-cause dismissal, although the proper award remains for the tribunal to determine from the case. See Agabon v. NLRC.
No proven just cause: the dismissal is illegal even if notices and conferences were conducted. Remedies may include reinstatement without loss of seniority, full backwages and benefits, or separation pay in lieu of reinstatement when legally appropriate.
Unjustified preventive suspension: the employer may owe wages for the suspension period.
Privacy, wage-deduction, retaliation, or defamatory conduct: separate liabilities may arise depending on the facts.

Procedural fairness cannot create evidence that does not exist, and strong evidence cannot excuse the failure to provide the required process.

Frequently asked questions

Can an employee be dismissed immediately if CCTV or system logs appear conclusive?

Generally, no. The employer may secure property, restrict access, or impose a lawful preventive suspension, but it should still issue a detailed notice, allow at least five calendar days to answer, consider the defense, and issue a separate decision.

Is an in-person hearing always required?

No. A meaningful written explanation may be sufficient. A hearing or conference is required when requested by the employee in writing, when substantial evidentiary disputes exist, when company rules or practice require it, or when similar circumstances justify it.

What if the employee admits altering the record?

The admission is important but should be accurately recorded, voluntary, and assessed in context. The employer should still determine what was altered, why, under whose instruction, and whether the admission establishes intentional fraud and the charged just cause.

What if the employee refuses to answer?

The employer may decide on the evidence after proving that a sufficiently detailed notice, adequate time, and a meaningful opportunity to respond were provided. Refusal does not establish guilt by itself.

Does every false entry amount to dismissible fraud?

No. The employer must distinguish intentional deception from a mistake, correction, system malfunction, misunderstanding, shared access, or negligence. The employee’s role, purpose, benefit, concealment, and surrounding evidence are critical.

Must the employer wait for a criminal case to finish?

No. The proceedings are independent and use different standards of proof. Neither a criminal complaint nor an acquittal automatically determines the labor case.

May the employer extend preventive suspension beyond 30 days?

Only on paid status, unless another lawful arrangement applies. After 30 days, the employee must be reinstated to the former or a substantially equivalent position, or receive wages and benefits during the extension.

Can the employer deduct the alleged loss from salary or final pay?

Not merely because it alleges fraud. Any deduction must have a lawful basis and comply with wage-protection rules. The employer may pursue appropriate recovery remedies separately.

Does resignation end the investigation?

Not necessarily. The employer may preserve evidence and pursue lawful civil, criminal, insurance, regulatory, or internal-control action. The resignation’s voluntariness and timing may also become disputed, particularly if the employee was pressured to resign.

Official references

This article provides general legal information, not advice for a specific investigation, dismissal, or criminal case. The applicable result may change based on the evidence, employment contract, company rules, collective bargaining agreement, industry-specific regulations, and later legal developments. Official sources were last checked on August 3, 2026.