If someone is using a company ID without permission—whether it is stolen, altered, copied, photographed, or retained after employment—the immediate priorities are to stop further use, protect affected people and systems, and preserve evidence. Philippine law does not contain one offense specifically called “misuse of a company ID.” The possible case depends on what the person did with the ID: falsification, online identity theft, estafa or fraud, unauthorized processing of personal data, trespass, theft, or an employment-policy violation may apply.

What Counts as Misuse of a Company ID?

A company ID is more than a plastic badge. It may show:

The employee’s name and photograph
Employee or personnel number
Job title and department
Company name and logo
Signature, QR code, barcode, RFID, or magnetic data
Building, computer, parking, or facility-access permissions

Misuse may involve a genuine ID, a fake ID, or merely a photograph or digital copy.

Situation	Possible legal issue	Immediate priority
A person alters the photograph, name, position, or validity date	Falsification of a private, commercial, or electronic document	Secure the fake ID and preserve proof of alteration
A former employee uses an unreturned ID to act for the company	Fraud, estafa, civil liability, and employment consequences	Revoke the ID and warn affected clients or vendors
Someone posts or sends another employee’s ID online	Computer-related identity theft and possible Data Privacy Act violations	Preserve URLs, screenshots, account details, and message headers
A person uses the ID to collect goods, enter premises, or obtain services	Estafa, trespass, theft, or another property offense depending on the facts	Notify security, the merchant, courier, bank, or property administrator
An employee lends an ID to another person	Company-policy violation and possible breach of trust	Suspend access and conduct a documented internal investigation
A fake recruiter displays a company ID to collect “application fees”	Estafa and computer-related identity theft	Warn applicants and report the account and payment channels

A genuine, unaltered company ID used without permission is not automatically a falsified document. However, the surrounding deception, unauthorized use of identity information, resulting damage, or entry into restricted premises may create criminal or civil liability.

Philippine Laws That May Apply

Falsification and Use of a Falsified Company ID

Articles 171 and 172 of the Revised Penal Code cover falsification by private individuals and the knowing use of falsified documents. Prohibited acts may include counterfeiting a signature, making it appear that a person participated in an act when they did not, altering true dates, or changing a genuine document so that it states something false. (Lawphil)

A company ID issued by a private employer will commonly be examined as a private document, although prosecutors and courts determine its legal classification from its purpose, contents, and use. For falsification of a private document, the prosecution generally must establish damage to another person or an intention to cause such damage. For use of a falsified document, the user must ordinarily know that the document is false.

Republic Act No. 10951 of 2017 increased the maximum fine under Article 172 to ₱1 million. The imprisonment and actual sentence depend on the specific paragraph violated, whether the person created or merely used the false document, and the applicable sentencing rules. (Lawphil)

Examples include:

Replacing the photograph on an employee’s ID
Changing “former employee” records to make the ID appear active
Creating a fake managerial or executive ID
Modifying a QR code so it links to a false verification page
Knowingly presenting a counterfeit ID to obtain access, money, goods, or authority

Computer-Related Identity Theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, punishes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another natural or juridical person, without right. A juridical person includes a corporation or other legal entity. The law expressly recognizes that the offense may exist even before damage occurs, although the prescribed penalty is lower when no damage has yet been caused. (Lawphil)

This law may apply when a person:

Uses a photograph of an employee ID in an online scam
Creates a fake social media, email, or messaging account using company credentials
Sends a scanned ID to impersonate an employee or authorized representative
Uses company-identifying information to create false digital documents
Obtains or circulates ID records from a hacked HR, security, or visitor-management system

Mobile phones and smartphones fall within the Cybercrime Prevention Act’s broad treatment of computers, so conduct through messaging applications or social media can qualify as computer-related activity. (Lawphil)

Estafa When the ID Is Used to Obtain Money or Property

Article 315 of the Revised Penal Code punishes estafa, commonly called swindling, when a person uses deceit or abuse of confidence to cause another person to part with money, goods, credit, or property. The penalties and monetary thresholds were amended by Republic Act No. 10951. (Lawphil)

A company ID may be part of the deceit when, for example:

A fake employee convinces a supplier to release equipment
A supposed recruiter collects application, medical, or training fees
A person instructs a client to send payment to a substituted bank or e-wallet account
Someone claims to be an authorized purchasing officer and orders goods on credit
A former employee collects payments or documents from customers

The ID alone does not establish estafa. Investigators will look for a false representation, reliance by the victim, and financial or property damage. Where the plan was interrupted before a loss occurred, attempted estafa or another offense may be evaluated from the overt acts already committed.

Data Privacy Act Violations

A company ID usually contains personal information because it identifies or can reasonably identify an individual. Republic Act No. 10173, or the Data Privacy Act of 2012, penalizes certain forms of unauthorized processing, access, disclosure, and improper disposal of personal information. “Processing” is broad and can include collecting, recording, storing, copying, using, sharing, or publishing ID information. (Lawphil)

The Data Privacy Act can become relevant in two different ways:

The offender misuses the employee’s personal data. This may involve an unauthorized copy, online publication, sale, or use of the employee’s name, photograph, signature, or ID number.
The company suffers a security incident. If ID records were obtained from an HR system, badge database, email account, cloud drive, or access-control platform, the company must assess whether a reportable personal data breach occurred.

Notification to the National Privacy Commission and affected data subjects is required within 72 hours when information that can enable identity fraud was acquired by an unauthorized person and the incident is likely to create a real risk of serious harm. Not every lost badge automatically meets this threshold; the company’s data protection officer should document the risk assessment. (National Privacy Commission)

Civil Damages and Injunctive Relief

Articles 19, 20, and 21 of the Civil Code of the Philippines require people to act with justice, honesty, and good faith and provide compensation when unlawful, negligent, or bad-faith conduct causes damage. (Lawphil)

Depending on the evidence, the company or affected employee may seek:

Reimbursement of money or property lost
Costs incurred in replacing credentials and containing the incident
Proven business interruption or reputational loss
Damages for misuse of personal information or identity
An injunction directing the offender to stop using the ID, company name, or personal data
Attorney’s fees when legally recoverable

Actual damages must be supported by receipts, transaction records, accounting entries, contracts, or other competent proof. Public accusations and exaggerated damage claims can weaken an otherwise valid case.

Employment Consequences When an Employee Is Involved

Article 297 of the Labor Code recognizes serious misconduct and fraud or willful breach of trust as possible just causes for termination. However, misuse of an ID does not make dismissal automatic. The employer must establish the misconduct through substantial evidence and follow procedural due process. Loss of trust must be based on clearly established facts, not rumor or suspicion. (Lawphil)

The usual process is:

Give the employee a detailed written notice stating the specific acts, dates, evidence, and company rules involved.
Give a reasonable opportunity to explain. Under King of Kings Transport, Inc. v. Mamac, this ordinarily means at least five calendar days from receipt of the first notice.
Conduct a conference when requested, required by company rules, or necessary because substantial factual disputes exist.
Evaluate the explanation and evidence impartially.
Issue a written decision stating the findings and penalty.

The first notice should not merely say “misuse of company ID.” It should identify what the employee allegedly did, how the ID was used, who received or relied on it, and what rule or duty was violated. (Lawphil)

What to Do Immediately After Discovering Company ID Misuse

1. Deactivate the ID and Related Access

Act as soon as the misuse is confirmed or reasonably suspected.

Disable the badge, RFID, QR code, building access, parking access, and visitor privileges.
Reset passwords or credentials linked to the same employee record.
Mark the ID as lost, stolen, expired, or revoked in the security database.
Inform reception, guards, branch offices, and affected facilities.
Ask vendors or clients to verify future instructions through an official number or email address.
Preserve access records before changing or deleting system entries.

Do not circulate a full, unredacted copy of the ID in a company-wide warning. A notice should normally show only the information necessary to identify the invalid credential.

2. Preserve Evidence Before Accounts or Records Disappear

Create an evidence folder with restricted access. Keep original files whenever possible.

Collect:

The original ID, counterfeit card, or printed copy
Clear photographs of the front and back
Screenshots showing the complete profile, username, URL, date, and time
Emails with their original headers
Chat exports, voice messages, and call logs
CCTV footage and door-access records
Courier, visitor, parking, or building logs
Bank, e-wallet, invoice, purchase-order, and delivery records
The company’s ID-issuance and return records
Specimen signatures and authorized-signatory lists
Names and contact details of witnesses
Records showing when employment or authority ended

Do not crop screenshots so tightly that the account, date, or platform becomes impossible to identify. Do not edit the original file to add arrows or labels; make an annotated working copy and keep the original unchanged.

For online incidents, immediately send the platform, bank, courier, email provider, or telecom company a written preservation request. Private companies may not release subscriber records without proper legal authority, but an early request can reduce the risk that routine retention periods expire.

3. Prepare a Written Incident Report

A useful incident report should answer:

Who discovered the misuse?
When and where was it discovered?
What exact ID or digital copy was used?
Was the credential genuine, altered, expired, or counterfeit?
What statements did the user make?
Who relied on those statements?
Was money, property, access, or data obtained?
Which systems or people may still be at risk?
What containment measures were taken?
What documents and witnesses are available?

Separate confirmed facts from assumptions. For example, write “The account displayed Employee A’s ID” rather than “Employee A created the account” unless there is evidence connecting the employee to it.

4. Notify Parties Who May Still Act on the Fake Authority

Send a factual fraud alert to affected parties, such as:

Banks and e-wallet providers
Suppliers and purchasing departments
Customers and collection agents
Couriers and warehouse operators
Condominium, office, or building administrators
Recruitment applicants
Online marketplaces and social media platforms

The notice should state that the ID or claimed authority is invalid, identify the affected date or transaction, and provide an official verification channel. Avoid publicly naming a suspected offender unless there is a legitimate need and sufficient factual basis.

When money has just been transferred, immediately ask the bank or payment provider to flag the transaction, attempt a recall, and preserve account records. Recovery is not guaranteed, particularly after funds have been withdrawn or moved through several accounts.

5. Report Physical or Offline Misuse to the Police

A local police station can record incidents involving a stolen badge, unauthorized entry, collection of goods, threats, or face-to-face fraud.

Bring:

A government-issued ID
The company ID or a clear copy
The incident report and chronology
Transaction records
CCTV stills or footage
Witness information
Proof that the ID was revoked or used without authority
Corporate authorization if the complainant acts for a company

A police blotter records that an incident was reported. It is useful for establishing an early timeline, but it is not a court judgment and does not by itself commence prosecution.

Barangay conciliation is generally not required for serious falsification or cybercrime offenses whose maximum penalties exceed the Katarungang Pambarangay limits. Urgent action to prevent continuing harm is also an exception to prior barangay proceedings. Minor disputes may still be referred to the barangay when the parties and subject matter fall within its jurisdiction. (Lawphil)

6. Report Online Misuse to the NBI or PNP Anti-Cybercrime Group

For social media impersonation, email fraud, hacked records, digital copies, or online transactions, report the matter to:

The National Bureau of Investigation Cybercrime Division or a Regional Cybercrime Center
The Philippine National Police Anti-Cybercrime Group or the appropriate regional unit
The DOJ Office of Cybercrime, when appropriate

The NBI’s official citizen procedure for computer-crime complaints provides for a complaint sheet, preliminary interview, sworn statements, collection of supporting documents, and examination of a relevant device when necessary. The listed intake process has no NBI fee and an indicative processing time of about one hour and ten minutes, but the actual investigation, digital forensics, identification of account holders, and preparation of a criminal complaint can take substantially longer. (National Bureau of Investigation)

Investigators may ask for the original phone, laptop, storage device, or account access. Before surrendering a device, back up lawful personal or business data, record its make and serial number, and obtain an acknowledgment or evidence-receipt document.

7. File a Criminal Complaint With the Prosecutor’s Office

A criminal case commonly proceeds through a complaint for preliminary investigation before the Office of the City Prosecutor or Office of the Provincial Prosecutor with territorial jurisdiction.

Typical requirements include:

Investigation Data Form
Notarized complaint-affidavit
Sworn statements of witnesses
Copies of the questioned ID and genuine company records
Screenshots, messages, access logs, CCTV, and transaction documents
Proof of loss or damage
Respondent’s known name and address
Corporate secretary’s certificate, board resolution, or written authority when a representative files for a corporation

The Department of Justice’s preliminary-investigation requirements should be checked before filing because local offices may require a specific number of copies based on the number of respondents. (Department of Justice Philippines)

After filing, the prosecutor may issue subpoenas, receive counter-affidavits and replies, and determine whether sufficient grounds exist to file charges in court. Straightforward cases may be resolved in several weeks, while cases involving unidentified online users, multiple respondents, foreign platforms, or forensic examinations can take months.

8. Assess Whether an NPC Report or Complaint Is Necessary

When the company’s ID database or employee information may have been compromised, the data protection officer should:

Identify the information exposed.
Determine how the unauthorized person obtained it.
Contain the access or disclosure.
Assess the likelihood of identity fraud or serious harm.
Decide whether the 72-hour notification rule applies.
Document the reasons for reporting or not reporting.
Submit required notifications through the NPC’s breach-reporting system.

An affected employee or other data subject may also file a complaint with the National Privacy Commission. Under the NPC’s current procedure, the complainant usually must first inform the respondent or personal information controller in writing and allow it an opportunity to act, subject to exceptions such as urgent harm, lack of an effective remedy, or patently illegal conduct. Failure to respond or take appropriate action within 15 calendar days can support exhaustion of this requirement. (National Privacy Commission)

The NPC complaint procedure requires a properly completed and notarized complaint, supporting evidence, and submission in person, by courier, or through an authorized electronic method. The current NPC fee schedule lists a basic complaint filing fee of ₱500, with additional fees for certain damages claims or applications. (National Privacy Commission)

Documents, Fees, and Indicative Timelines

Action	Common documents	Fees and timing
Internal containment	Incident report, ID record, access logs, revocation notice	Should begin the same day; internal cost only
Police report	Valid ID, incident narrative, questioned ID, transaction and witness evidence	Usually completed during the visit; investigation continues afterward
NBI Cybercrime complaint	Complaint sheet, sworn statements, devices, screenshots, transaction records	No intake fee listed; citizen-charter intake is approximately 1 hour and 10 minutes
Prosecutor complaint	Complaint-affidavit, witness affidavits, evidence, respondent details, corporate authority	Notarization and copying costs vary; resolution commonly takes weeks or months
NPC breach notification	Breach assessment, incident details, affected-data information, mitigation measures	Within 72 hours when the legal notification threshold is met
NPC formal complaint	Notarized form, evidence, proof of prior written notice or applicable exception	Basic filing fee currently ₱500; proceedings may take several months
Filing from abroad	Affidavit, passport copy, SPA or corporate authority, supporting evidence	Consular-notarial or apostille fees depend on the country and service used

Agency processing periods are not guarantees. Delays commonly result from incomplete addresses, unsuccessful service of subpoenas, missing original records, unavailable witnesses, platform-response delays, and the need for digital forensic examination.

Special Considerations for Foreigners and People Abroad

A foreign national may report company ID misuse committed in the Philippines or involving personal data processed in the Philippines. The NPC’s citizen-service materials expressly cover foreign nationals whose personal data are processed in the country. (National Privacy Commission)

A complainant abroad should prepare:

A detailed affidavit describing the incident
A passport or other reliable identity document
Complete electronic evidence and transaction records
A Special Power of Attorney if a Philippine representative will file or receive documents
Corporate authorization if acting for a foreign company
A certified English translation of documents written in another language

An affidavit or SPA executed abroad may generally be notarized before a Philippine embassy or consulate. In a country covered by the Apostille Convention, a document notarized locally may instead require an apostille from that country’s competent authority. The receiving Philippine agency may still request originals, certified copies, translations, or proof of the representative’s authority. (Philippine Embassy in New Delhi)

A foreign company should anticipate requests for its registration documents, proof of juridical personality, and a board resolution or secretary’s certificate authorizing the person who signs the complaint.

Common Company ID Misuse Scenarios

A Former Employee Uses an Old ID

An ID does not remain valid simply because the company failed to recover the physical card. The employer should formally mark it revoked, deactivate linked access, notify relevant branches, and preserve the employee’s clearance and separation records.

If the former employee merely possesses the old card, criminal liability is not automatic. Liability becomes more likely when the person knowingly presents it as active, represents that they still have authority, obtains access or property, or deceives another person.

An Employee Lends an ID to a Friend or Relative

Even without financial loss, lending an access badge may violate security and confidentiality policies. The employer should determine:

Whether the lending was intentional
What access the other person obtained
Whether personal or confidential data were exposed
Whether the employee tried to conceal the incident
Whether similar violations were treated consistently

Discipline should be based on the seriousness of the breach and the company’s rules, not simply the embarrassment caused by the incident.

A Fake Recruiter Uses a Company ID

Fake recruiters frequently use an ID photograph, company logo, copied employee profile, and professional-looking email address to appear legitimate. The company should publish a narrowly tailored fraud advisory stating its official recruitment channels, whether it charges applicant fees, and how applicants can verify recruiters.

Victims should preserve payment receipts, account numbers, phone numbers, advertisements, interview links, and the ID image before the account is removed.

A Stolen ID Is Used to Enter a Building

Immediately deactivate the badge and ask the building administrator to preserve access logs and CCTV. Record the exact entrance, time, floor, and persons approached. Depending on the circumstances, the incident may involve trespass, theft, attempted theft, fraud, or another offense in addition to ID misuse.

Someone Uses an Employee’s ID to Open or Verify an Account

Contact the institution in writing and state that the ID was used without authority. Ask for:

Immediate restriction or review of the account
Preservation of the application and verification records
The institution’s fraud-reference number
Correction of records connecting the employee to the account
Written confirmation of the investigation’s outcome, subject to lawful disclosure limits

The affected employee should also review bank, e-wallet, telecom, lending, and online accounts for suspicious activity.

Mistakes That Can Damage the Case

Deleting the Fake Account Before Saving Evidence

Reporting an account may cause it to disappear. Capture the account, posts, messages, username, URL, and payment instructions first.

Treating the Police Blotter as the Entire Case

A blotter is an initial record. A complaint-affidavit, supporting evidence, witness cooperation, and prosecutor evaluation are usually still necessary.

Filing Only an Affidavit of Loss

An affidavit of loss explains that the ID is missing. It does not document later impersonation, fraud, or unauthorized transactions. Prepare a separate incident report and complaint evidence.

Publicly Accusing Someone Without Adequate Proof

Posting the suspect’s name and photograph may create privacy, employment, or defamation problems. Use controlled notifications directed to people who genuinely need the warning.

Immediately Dismissing a Suspected Employee

Even strong evidence does not remove the employer’s obligation to provide notice and an opportunity to explain. An unlawful procedure can expose the employer to a labor case despite underlying misconduct.

Failing to Show Corporate Authority

A complaint signed for a corporation may be delayed if the filer cannot show authority. Prepare the board resolution, secretary’s certificate, or comparable authorization before filing.

Waiting for a Complete Investigation Before Containment

Evidence gathering is important, but it should not delay deactivation of access, warnings to payment providers, or protection of affected personal data.

Frequently Asked Questions

Is using someone else’s company ID automatically a crime?

Not automatically. Investigators must examine whether the ID was stolen, altered, knowingly used to deceive, used online without right, or used to obtain access, money, property, or personal information. It may still violate company policy even when the facts do not establish a criminal offense.

Is a company ID considered a public document?

Usually not. An ID issued by a private employer is generally a private-company record. Its legal classification may depend on its nature and use. A government employee’s official ID or a document incorporated into an official transaction may require a different analysis.

What if the company ID is genuine but the user is not the employee?

That may not be document falsification if the card itself was not altered. However, presenting it as one’s own can support identity theft, estafa, trespass, theft, or another offense depending on the purpose and resulting harm.

Can a former employee be charged for using an expired company ID?

Possibly. Mere possession is different from knowingly presenting the ID as active. Criminal exposure becomes stronger when the former employee claims current authority, enters restricted premises, obtains money or goods, or causes another person to rely on the false representation.

Can an employer dismiss an employee for lending or misusing an ID?

Yes, when the conduct constitutes serious misconduct, fraud, or willful breach of trust and the facts are supported by substantial evidence. The employer must still follow the notice-and-opportunity-to-explain requirements.

Where should online company ID misuse be reported?

Report it to the platform and consider the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or local police. A criminal complaint may later be filed with the appropriate city or provincial prosecutor.

Do I need to go to the barangay first?

Usually not for serious falsification or cybercrime charges that exceed the barangay’s penalty limits. Barangay proceedings may apply to qualifying minor disputes between parties within the required locality, but urgent evidence preservation and fraud containment should not be delayed.

Can I report the misuse even if no money was lost?

Yes. Computer-related identity theft can be punishable even before damage occurs. A fake or altered document, unauthorized system access, attempted fraud, privacy violation, or employment breach may also exist without completed financial loss.

Can the National Privacy Commission order action against the offender?

The NPC can investigate matters within the Data Privacy Act, issue appropriate orders, and impose administrative sanctions within its authority. A privacy complaint does not replace a police, NBI, prosecutor, labor, or civil case when those separate remedies are applicable.

Can I file a complaint while outside the Philippines?

Yes. You may execute affidavits abroad and appoint a Philippine representative through a properly authenticated or apostilled Special Power of Attorney. Confirm the receiving agency’s current requirements for originals, notarization, apostille, translations, and electronic submission.

Key Takeaways

Deactivate the ID and linked access immediately, but preserve logs and original evidence.
A fake or altered company ID may constitute falsification under Articles 171 and 172 of the Revised Penal Code.
Online use of another person’s or company’s identifying information may constitute computer-related identity theft under RA 10175.
When deception causes someone to release money, goods, or property, estafa may apply.
ID data misuse or a compromised badge database may trigger the Data Privacy Act and, in qualifying breaches, the 72-hour notification rule.
A police blotter documents the report but does not replace a sworn complaint and supporting evidence.
Employers must investigate fairly and observe labor due process before imposing dismissal.
People filing from abroad should prepare authenticated or apostilled affidavits, authority documents, and certified translations when required.