Quick answer

The most likely charge is qualified theft under Articles 308 and 310 of the Revised Penal Code when an employee takes company money that was accessible only because of the employee’s trusted position, while the company retained legal—or “juridical”—possession of the funds.

The charge may instead be estafa through misappropriation or conversion under Article 315(1)(b) when the employee received not merely physical custody but juridical possession of the money under a genuine agency, trust, commission, administration, or comparable obligation to deliver or return it.

The employee’s job title does not settle the issue. What matters is the actual arrangement: who legally possessed the funds, what authority the employee had, why the money was entrusted, and how it was diverted. A cashier, teller, collector, payroll employee, or accounting clerk ordinarily has only material custody of money held for the employer, which points toward theft rather than estafa. An independent agent with an enforceable right to possess or retain the funds may fall under estafa.

Other charges—such as falsification or a cybercrime-related offense—may apply if the employee also fabricated records, altered documents, or used information and communications technology in a legally significant way. The prosecutor, not the company, ultimately determines which charge the evidence supports.

Qualified theft: the usual charge for a trusted employee

Theft under Article 308 generally requires proof that:

The accused took personal property belonging to another;
The taking was without the owner’s consent;
There was intent to gain; and
The taking involved neither violence or intimidation against persons nor force upon things.

Under Article 310, theft becomes qualified when committed under specified circumstances, including grave abuse of confidence. The penalty is two degrees higher than that for simple theft.

For company-fund cases, qualified theft may apply when an employee uses special access or custody arising from a position of substantial trust—for example, sole access to a vault, authority over collections and deposits, control of cash receipts, or responsibility for receiving and disbursing company funds.

Employment alone is not enough. In Balicbalic v. People, the Supreme Court explained that a cashier’s position does not automatically establish qualified theft. The prosecution must prove a high degree of confidence and show that the employee gravely exploited that particular trust to facilitate the taking. If the evidence proves an unlawful taking but not grave abuse of confidence, the proper charge may be simple theft.

The following facts commonly matter:

Whether the employee had exclusive or specially authorized access to the money;
Whether the company relied on the employee to receive, safeguard, deposit, reconcile, or disburse funds;
Whether that access made the taking possible or materially easier;
Whether controls were bypassed using entrusted passwords, keys, approval rights, or custody;
Whether the employee merely encountered the funds by chance; and
Whether the employee had to break into or force access to an area from which the employee was normally excluded.

The qualifying circumstance must be alleged in the criminal charge and proved. It should not be assumed merely from the words “employee,” “cashier,” or “accounting staff.”

When the offense may be estafa

Article 315(1)(b) covers estafa when a person:

Receives money, goods, or other personal property in trust, on commission, for administration, or under another obligation involving a duty to deliver or return it;
Misappropriates or converts the property, or denies receiving it; and
Causes prejudice to another.

The critical issue is juridical possession. This means possession accompanied by a right over the property that the recipient may assert even against its owner. It is different from temporary physical custody.

The Supreme Court has repeatedly distinguished:

An employee who receives company money as a cashier, teller, clerk, or temporary custodian generally holds only material possession. Misappropriation ordinarily constitutes theft, qualified or otherwise.
A true agent or administrator who receives both physical and juridical possession may commit estafa by conversion.

For example, an employee required to turn over daily collections at the end of each shift normally does not acquire an independent legal right to possess those collections against the employer. Calling the employee an “agent” in an appointment letter is not conclusive if the actual duties show only custodial possession.

Conversely, estafa may be appropriate where the agreement gives the recipient autonomous possession, such as a genuine commission or agency arrangement under which the agent may lawfully retain the money in specified circumstances.

A prior demand is not an essential element or a condition that must always be satisfied before filing estafa. However, an unanswered demand to account for or return the money can be strong circumstantial evidence of conversion. A written demand is usually valuable because it documents the amount claimed, the employee’s explanation or silence, and the date the company asserted its rights.

Why the distinction matters

Qualified theft and estafa have different elements and penalty structures. Filing under the wrong theory can create a serious variance between the allegations and the evidence.

The distinction cannot safely be made from the shortage alone. Counsel should review:

The employment contract and job description;
Cash-handling and remittance policies;
Agency, commission, or trust agreements;
The employee’s authority to retain, apply, transfer, or disburse money;
Who had juridical possession at the moment of diversion;
How the employee obtained access; and
Whether each transaction was a separate taking or part of a legally provable continuing scheme.

The complaint-affidavit should narrate the underlying facts rather than simply label the conduct “qualified theft” or “estafa.”

Possible additional or alternative offenses

Depending on the evidence, prosecutors may also examine the following:

Falsification

Falsification provisions of the Revised Penal Code may apply if the employee made false entries, altered receipts, fabricated vouchers, forged signatures, or changed commercial or private documents to conceal a shortage.

A bookkeeping discrepancy, unsupported entry, or inaccurate report is not automatically criminal falsification. The prosecution must establish the particular document, the prohibited alteration or false statement, the employee’s participation, and the required criminal intent.

Cybercrime-related liability

Section 6 of the Cybercrime Prevention Act may become relevant when an offense under the Revised Penal Code or another special law is committed by, through, and with the use of information and communications technology. Its application can affect the penalty.

The mere fact that company records were electronic does not by itself settle the issue. Preserve proof showing exactly how online banking, accounting software, email, access credentials, or another computer system was used.

Unauthorized access, identity misuse, payment-card activity, or manipulation of electronic data may also raise separate offenses under applicable special laws. These should be assessed from the actual transaction records rather than added mechanically to the complaint.

Malversation

Ordinary private-company money is not “public funds,” and an ordinary private employee is not an accountable public officer. Malversation generally does not apply merely because an employee embezzled company funds.

It may become relevant only in legally exceptional situations involving public funds or property and a person covered by the malversation provisions, including circumstances addressed by Article 222 of the Revised Penal Code.

Penalties depend on the amount and proven offense

Republic Act No. 10951 adjusted the monetary thresholds used in computing penalties for theft and estafa.

For theft under Article 309, the current amount bands include:

Not more than ₱500;
More than ₱500 but not more than ₱5,000;
More than ₱5,000 but not more than ₱20,000;
More than ₱20,000 but not more than ₱1,200,000;
More than ₱1,200,000 but not more than ₱2,200,000; and
More than ₱2,200,000, subject to the statutory rule for additional value.

Qualified theft is punished two degrees higher than the corresponding simple-theft penalty.

For estafa under Article 315, the relevant amount bands include:

Not more than ₱40,000;
More than ₱40,000 but not more than ₱1,200,000;
More than ₱1,200,000 but not more than ₱2,400,000; and
More than ₱2,400,000, subject to the statutory rule for additional value.

The final penalty cannot be calculated reliably from the total alleged loss alone. It may depend on the offense proved, the amount attributable to each count, the date of each act, whether separate transactions may lawfully be combined, qualifying or aggravating circumstances, mitigating circumstances, and sentencing laws such as the Indeterminate Sentence Law.

Repayment can affect civil liability and may be considered in appropriate circumstances, but it does not automatically erase criminal liability.

What the company should do immediately

1. Secure the money and systems

Revoke or limit access to bank accounts, payment platforms, accounting software, cash storage, approval workflows, passwords, tokens, company cards, and signing authorities. Preserve business continuity and avoid altering historical records.

2. Preserve original evidence

Keep authenticated or verifiable copies of:

Bank statements and bank certifications;
Deposit slips, withdrawal records, transfer confirmations, and check images;
Cash receipts, official receipts, invoices, ledgers, vouchers, and payroll records;
Audit trails, system logs, user-access records, and login histories;
Emails, business messages, approval requests, and acknowledgments;
CCTV footage and access-control records;
Contracts, job descriptions, policies, and authority matrices;
Internal audit reports and reconciliation worksheets;
Written admissions, explanations, or promises to repay; and
Records identifying who obtained each item and when.

For electronic evidence, preserve native files, metadata, export logs, and read-only copies where possible. Document the chain of custody. Screenshots alone may omit information needed to authenticate a transaction.

3. Reconstruct each questioned transaction

Prepare a schedule stating the date, amount, source account, destination, supporting document, authorized purpose, actual disposition, approving persons, and evidence connecting the employee to the act.

Do not rely solely on a single “total shortage” figure. Separate transactions may require separate factual allegations or counts.

4. Conduct a fair internal investigation

Obtain statements from witnesses with personal knowledge. Give the employee a meaningful opportunity to explain discrepancies, particularly if disciplinary action is being considered.

A criminal complaint and an employment case are separate matters. Dismissal still requires a valid labor-law ground and procedural due process. An accusation, audit exception, or pending criminal complaint does not by itself prove just cause for termination.

5. Send a carefully drafted demand when appropriate

A demand can require the employee to account for identified funds, return company property, and explain particular transactions by a reasonable date. State only amounts supported by records.

Do not threaten violence, public humiliation, or an accusation against relatives. Avoid demanding a confession or using coercion to obtain one. Demand is useful evidence in many cases but is not a substitute for proving taking or conversion.

6. Obtain corporate authority

The person signing for a corporation should be able to show authority to act. Depending on the corporation’s structure and the prosecutor’s requirements, this may involve a secretary’s certificate, board authorization, or other proof that the representative may execute the complaint-affidavit and testify for the company.

7. File in the proper place

A complaint is generally filed with the Office of the City or Provincial Prosecutor having territorial authority over the place where the offense, or an essential element of it, occurred. Police or the National Bureau of Investigation may assist with fact-finding, digital evidence, or transaction tracing.

Venue can be complicated when money was collected in one city, transferred online from another, and credited elsewhere. Filing in the wrong locality can delay the case, so confirm venue before submission.

Current prosecutor investigation tracks

Under the 2024 DOJ–National Prosecution Service rules, the investigation track generally depends on the penalty prescribed by law:

Summary investigation: offenses punishable by imprisonment from one day to one year, a fine regardless of amount, or both;
Expedited preliminary investigation: generally offenses punishable by one year and one day to six years that fall within first-level court jurisdiction; and
Regular preliminary investigation: offenses carrying at least six years and one day, and cases otherwise assigned to that process.

Because the amount and qualification can substantially increase the penalty, many significant qualified-theft or estafa complaints will require regular preliminary investigation. The prosecutor may require a complaint-affidavit, witness affidavits, supporting documents, and proof of corporate authority. The respondent is ordinarily given an opportunity to submit counter-affidavits.

The applicable DOJ rules govern prosecutorial investigations; court proceedings remain governed by the Rules of Court and Supreme Court issuances.

Do not delay: prescription varies

There is no single filing deadline for every employee-fund case. Under Articles 90 and 91 of the Revised Penal Code, prescription depends principally on the penalty attached to the offense. Depending on the charge and amount, the period may be only a few years or may extend to 10, 15, or 20 years.

The period generally begins from discovery of the offense by the offended party, the authorities, or their agents, subject to Article 91 and the facts of the case. Separate acts may have separate dates. In 2025, the Supreme Court reaffirmed that filing the complaint with the prosecution office for investigation interrupts the prescriptive period.

Do not postpone filing simply because an internal audit, repayment negotiation, or employment proceeding is ongoing. Have counsel calculate prescription from the earliest defensible date and preserve proof of when the company discovered each transaction.

Common mistakes that weaken a complaint

Charging estafa solely because the employee “received” the money, without proving juridical possession;
Assuming every employee theft is qualified theft;
Presenting only an unexplained audit total instead of transaction-level evidence;
Failing to connect the accused to the withdrawal, transfer, false entry, or missing cash;
Combining separate transactions without analyzing whether separate counts are required;
Relying on unauthenticated screenshots or edited spreadsheets;
Overwriting logs or allowing CCTV footage to be automatically deleted;
Filing in a locality with no connection to an essential element of the offense;
Treating resignation, dismissal, repayment, or an affidavit of desistance as automatically ending criminal liability;
Publishing accusations before charges are proved, creating possible privacy, labor, or defamation exposure; and
Forcing a confession, seizing a personal device without legal authority, or accessing a private account using improperly obtained credentials.

When legal help is urgent

Consult Philippine criminal counsel promptly when:

The suspected loss is continuing;
Funds may be transferred, withdrawn, or concealed;
Evidence is stored on systems with short retention periods;
Several employees, approvers, or outside recipients may be involved;
The transactions cross cities, countries, banks, or payment platforms;
The employee disputes the audit or claims authority to use the money;
The company is considering both termination and criminal filing;
Prescription may be close;
The complaint may involve falsified or electronic evidence; or
Police, prosecutors, or another agency has already contacted the company or employee.

An employee accused of misappropriation should also obtain independent counsel before signing an admission, repayment agreement, waiver, or affidavit. The employee should preserve records supporting authorization, turnover, reimbursement, accounting errors, or another lawful explanation.

Frequently asked questions

Is qualified theft always the correct case against a cashier or collector?

No. It is often the relevant charge because the employee ordinarily has only physical custody while the employer retains juridical possession. But qualified theft additionally requires proof of grave abuse of confidence. Without that proof, the offense may be simple theft.

Can the company file estafa and qualified theft for the same missing money?

A complaint may present the facts and identify possible offenses, but the same act should not be indiscriminately charged under inconsistent theories. The prosecutor must determine whether the accused had material possession only or juridical possession. Separate conduct may support separate offenses, but double-jeopardy and duplicity concerns require careful analysis.

Must the company make a written demand before filing?

Not necessarily. Demand is not an essential element of estafa under Article 315(1)(b) when conversion is otherwise proved, and it is not an element of theft. A properly documented demand may nevertheless provide useful evidence of failure to account or return funds.

Does repayment prevent a criminal case?

No. Full or partial repayment generally does not extinguish a public offense that has already been committed. It may reduce the unpaid civil liability and may have other legal effects, but it does not guarantee dismissal.

What if the employee claims the shortage was an accounting error?

A shortage alone does not prove criminal intent. The company should reconcile source records, identify the questioned transactions, rule out timing and posting errors, and establish the employee’s participation and intent through admissible evidence.

Can the company dismiss the employee immediately?

Not merely because a criminal complaint is contemplated. Dismissal and criminal prosecution are separate processes. Any termination must rest on a lawful ground and comply with labor due process. Temporary workplace measures should also comply with labor rules and be proportionate to the actual risk.

Who decides the final charge?

The prosecutor determines whether the evidence establishes the required basis to file an information in court and what offense the evidence supports. Conviction requires the prosecution to prove every element beyond reasonable doubt.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The proper charge, venue, filing procedure, prescription period, and potential liability depend on the documents and specific transactions. Official sources were checked for currency on July 24, 2026.