Quick answer

An employer may investigate suspected employee fraud or falsified records, but suspicion alone does not justify dismissal. For a private-sector dismissal to be lawful, the employer must establish both:

A valid just cause supported by substantial evidence, such as fraud, a willful breach of trust, serious misconduct, or another applicable ground under Article 297 of the Labor Code; and
Procedural due process, ordinarily consisting of a detailed first written notice, a meaningful opportunity to answer and present evidence, a fair evaluation of the defense, and a written notice of the final decision.

The first notice should give the employee at least five calendar days from receipt to prepare an explanation. A formal trial-type hearing is not automatically required in every case, but a conference or hearing should be held when the employee requests one in writing, when company rules require it, or when substantial factual disputes are better resolved through questioning and presentation of evidence.

These rules primarily concern private-sector employment. Government personnel are governed by the separate 2025 Rules on Administrative Cases in the Civil Service, applicable civil-service laws, and any special rules governing their office.

What conduct may constitute fraud or falsification

Employee fraud may include intentionally using deception to obtain a benefit, conceal a shortage, misappropriate property, defeat an internal control, or cause the employer to rely on false information. Falsification may involve deliberately creating, changing, backdating, signing, submitting, or approving a false record.

Depending on the evidence and the employee’s duties, examples may include:

False time, attendance, payroll, overtime, leave, reimbursement, or expense records;
Fabricated receipts, invoices, purchase orders, delivery records, inventory entries, or liquidation documents;
Unauthorized alteration of sales, accounting, customer, production, quality-control, or compliance records;
False credentials or employment documents material to the job;
Use of another person’s login, signature, approval authority, or identity to create a misleading record;
Concealment of shortages, unauthorized transactions, or conflicts of interest; or
Collusion with another employee, supplier, customer, or contractor.

An incorrect record is not automatically fraudulent. The employer must examine whether the discrepancy resulted from an intentional act, an honest mistake, poor training, a system error, an unclear procedure, negligence, or another person’s intervention.

The legal grounds must match the proven conduct

Article 297 of the Labor Code permits termination for specified just causes, including serious misconduct, fraud or willful breach of trust, and other analogous causes. The charge should identify the ground actually supported by the facts instead of treating every record discrepancy as “fraud.”

Fraud or willful breach of trust

For loss of trust and confidence to justify dismissal, the employee generally must occupy:

A managerial position involving management responsibility; or
A fiduciary rank-and-file position that regularly handles significant money, property, records, approvals, or other matters requiring special trust, such as a cashier, auditor, or property custodian.

There must also be a work-related act that genuinely justifies the loss of trust. The Supreme Court has emphasized that the breach must be intentional, knowing, and purposeful—not merely careless or inadvertent—and must rest on substantial evidence rather than suspicion. See Jalit v. Dohle-Philman Manning Agency, Inc..

An employer cannot simply label any employee a “position of trust.” The actual job functions, access, accountability, and degree of discretion matter.

Serious misconduct

If the charge is serious misconduct, the conduct must be grave, related to the employee’s work, and show that the employee has become unfit to continue working for the employer. A minor procedural lapse or isolated error may not meet this standard.

Violation of company rules

A company rule can support discipline when it is lawful, reasonable, sufficiently communicated, and applicable to the conduct. The notice should identify the exact provision allegedly violated. The penalty must also be evaluated under the company’s disciplinary rules, any collective bargaining agreement, consistent past practice, and the circumstances of the case.

The employer’s burden of proof

If a dismissal is challenged, the employer bears the burden of proving its legality. The applicable standard in labor cases is generally substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

Mere allegations, unexplained spreadsheets, anonymous accusations, or conclusions such as “management has lost confidence” are not enough. The employer should be able to connect the employee to the questioned transaction or record and explain why the act was intentional and attributable to that employee.

Evidence may be direct or circumstantial. A sound circumstantial case should form a coherent chain rather than depend on speculation. Relevant evidence may include:

Original and altered versions of records;
Audit trails, access logs, timestamps, approval histories, and user-account records;
System configurations and evidence about whether credentials were shared;
CCTV recordings obtained and used lawfully;
Emails, messages, transaction records, and contemporaneous reports;
Specimen signatures or authenticated electronic approvals;
Inventory counts, cash reconciliations, bank records, and supplier confirmations;
Written statements or affidavits from witnesses with personal knowledge;
The employee’s job description, authority limits, and applicable policies; and
Evidence supporting or disproving possible innocent explanations.

Unverified hearsay can be especially weak when the person with direct knowledge is available but does not provide a statement. In Apex Mining Co., Inc. v. Atendido, the Supreme Court rejected generalized allegations and stressed that the employer must identify and prove the employee’s specific acts.

A defensible investigation process

1. Secure the records without deciding guilt in advance

Preserve potentially relevant paper and electronic records as soon as a credible issue arises. Restrict further alteration while maintaining ordinary business operations where possible.

Document:

Who collected each item;
When and where it was obtained;
The system or device from which it came;
Who had access to it;
What preservation method was used; and
Every transfer, copy, export, or material examination.

For electronic evidence, preserve the native file, available metadata, audit logs, and a read-only working copy where feasible. Screenshots alone may omit context and authentication information. The Rules on Electronic Evidence recognize electronic documents but require appropriate proof of their integrity and reliability when offered in proceedings.

Do not secretly alter files, fabricate a test transaction, impersonate the employee, or induce misconduct merely to create evidence.

2. Define the allegation precisely

Before issuing a notice, identify:

The questioned act or omission;
Date, time, location, transaction, and record involved;
The employee’s alleged participation;
The evidence supporting that allegation;
The applicable job duty or company rule; and
The Labor Code ground that may apply if the allegation is established.

The investigator should consider both incriminating and exculpatory material. The purpose is to determine what happened, not to assemble a one-sided justification for a decision already made.

3. Manage conflicts and confidentiality

The investigator or decision-maker should not have a personal interest in the outcome. If the immediate supervisor is the complainant, alleged accomplice, or subject of a related accusation, appoint another qualified person to investigate or decide.

Share information only with people who genuinely need it for the investigation, legal compliance, security, or decision. Avoid announcing that an employee is a “fraudster” before the matter is resolved. Unnecessary disclosure can cause reputational harm and create separate legal risks.

4. Issue a detailed notice to explain

The first written notice should state:

The specific acts or omissions charged;
The dates, transactions, documents, and material circumstances involved;
The applicable company provisions and possible Labor Code ground;
That dismissal is among the possible consequences, if it genuinely is;
The important evidence relied upon, with reasonable access to materials needed for a meaningful defense;
The deadline and method for submitting a written explanation;
Whether and how the employee may request a conference, present witnesses, or submit additional evidence; and
The investigator’s or HR contact details.

The employee should receive at least five calendar days from actual receipt to prepare a response. This period allows time to study the charge, consult a union representative or lawyer, gather records, and formulate a defense. A vague notice stating only “fraud,” “dishonesty,” or “loss of confidence” is inadequate. The Supreme Court explains these requirements in Reyes v. Global Beer Below Zero, Inc..

Keep proof of service. If personal service is refused or impracticable, use a traceable method consistent with applicable rules and send the notice to the employee’s last known address and other established communication channels where appropriate.

5. Give a genuine opportunity to answer

The employee should be allowed to:

Deny, admit, or explain each material allegation;
Identify system errors, shared access, authorization, or other responsible persons;
Submit documents and witness statements;
Challenge the accuracy, authenticity, or completeness of evidence;
Explain mitigating circumstances; and
Request reasonable access to records necessary for the defense.

A conference is particularly appropriate when credibility is central, records conflict, the employee requests it in writing, or the governing policy or collective bargaining agreement requires one. The employee may be assisted by counsel if desired, although an internal administrative conference is not a criminal trial.

Failure to answer does not automatically prove fraud. If the employee received a sufficient notice and a real opportunity to respond but chose not to participate, the employer may decide from the available evidence. The decision must still be supported by substantial evidence.

6. Evaluate the evidence impartially

The final assessment should address:

Whether the questioned record is actually false or altered;
Whether the employee created, directed, approved, used, or knowingly concealed it;
Whether the act was intentional;
Whether the employee obtained or sought a benefit, or caused or risked harm;
Whether access credentials could have been used by someone else;
Whether the relevant procedure was clear and consistently enforced;
Whether the defense is supported by records;
Whether similarly situated employees were treated consistently; and
Whether the proven conduct satisfies the charged legal ground.

Do not rely in the decision on a new accusation that the employee was never given a fair chance to answer. If material new evidence or a different charge arises, issue a supplemental notice and allow a reasonable response.

7. Impose a proportionate, authorized outcome

Possible outcomes include exoneration, counseling, retraining, a warning, suspension, restitution through a lawful arrangement, or dismissal. The proper outcome depends on the proven conduct, applicable rules, position of trust, intent, damage or risk, prior record, consistency of discipline, and any mitigating circumstances.

Do not impose salary deductions or withhold final pay merely to recover a suspected loss without a lawful basis and the required process. A criminal complaint, civil recovery, insurance claim, or internal disciplinary action may involve different standards and procedures.

8. Issue a written decision

If dismissal is imposed, the second written notice should state:

The charge or charges evaluated;
The material findings;
The employee’s explanation and evidence considered;
The basis for accepting or rejecting significant defenses;
The applicable rule and just cause established;
The penalty and effective date; and
Any internal appeal or review process.

The notice should show that the decision followed—rather than preceded—the employee’s opportunity to answer.

Preventive suspension is limited

Preventive suspension is not an automatic response to a fraud allegation and should not be used as advance punishment. In the private sector, it may be imposed when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers. In appropriate dishonesty cases, this may include a demonstrated risk of altering vital records, interfering with witnesses, or causing further property loss.

An unpaid preventive suspension may not exceed 30 days. After that period, the employer must:

Reinstate the employee to the former or a substantially equivalent position; or
Extend the suspension while paying the wages and other benefits due during the extension.

Pay received during a lawful extension is not refundable merely because the employee is later dismissed. A suspension imposed without sufficient basis may expose the employer to liability for the corresponding salaries. The governing limits are discussed in Lopez v. Irvine Construction Corp..

Less restrictive measures may be adequate, such as temporary reassignment, dual approval requirements, preservation holds, removal of access to particular systems, or supervised work. These measures must not be degrading, discriminatory, punitive, or so unreasonable that they amount to constructive dismissal.

Privacy and lawful evidence gathering

An investigation does not suspend employees’ privacy rights. The employer should identify a lawful basis for processing personal information and follow the principles of transparency, legitimate purpose, and proportionality under the Data Privacy Act.

The Data Privacy Act’s Implementing Rules recognize several possible grounds for lawful processing, including compliance with legal obligations and legitimate interests, subject to the employee’s fundamental rights. Sensitive or privileged information has stricter requirements.

Employers should:

Collect only information reasonably relevant to the allegation;
Observe the company’s privacy notice and monitoring policies;
Avoid indiscriminate searches of personal accounts, devices, or unrelated communications;
Limit access to authorized investigators and decision-makers;
Secure investigation files against loss, alteration, and unauthorized disclosure;
Keep records only as long as justified by legal, defense, and retention needs; and
Consult the data protection officer when monitoring, device imaging, biometrics, sensitive data, or large-scale extraction is involved.

Company ownership of a device does not create unlimited authority to inspect every personal communication. The legality of a search may depend on the policy communicated to employees, the purpose and scope of the search, the employee’s reasonable expectations, and other applicable laws.

Covert interception or recording may also raise issues under privacy, anti-wiretapping, cybercrime, and evidence laws. Obtain legal advice before using intrusive surveillance or accessing password-protected personal accounts.

An internal case is separate from a criminal case

Fraud or falsification at work may also suggest a criminal offense, but an internal finding does not itself establish criminal guilt. Conversely, an employer generally need not wait for a criminal conviction before completing a workplace investigation if substantial evidence establishes a valid employment ground.

A police or prosecutor referral should be based on verified facts and handled separately from the disciplinary decision. Do not threaten criminal prosecution merely to force a resignation, repayment, waiver, or confession.

Employees facing possible criminal exposure should obtain independent legal advice before signing admissions or detailed statements. Employers should also consult counsel promptly where the incident involves substantial losses, regulated records, government funds, personal-data breaches, financial reporting, or possible evidence tampering.

Evidence employees should preserve

An employee who receives an accusation should keep lawful copies of:

The notice to explain and proof of when it was received;
The job description and relevant company rules;
The written explanation and proof of submission;
Emails, messages, approvals, and instructions concerning the transaction;
Records showing who had access to the system, account, keys, cash, or documents;
Documents supporting authorization, correction of an error, or an innocent explanation;
Requests for evidence, extensions, a conference, counsel, or union assistance;
Minutes, invitations, and notes from conferences;
Preventive-suspension and termination notices; and
Payslips and records of unpaid wages or benefits.

Preservation does not authorize taking trade secrets, customer data, privileged communications, or unrelated confidential files. An employee should identify needed material and request access or preservation instead of improperly copying protected data.

Common mistakes

Mistakes by employers

Deciding to dismiss before asking for an explanation;
Issuing a generic notice with no dates, transactions, or supporting circumstances;
Allowing fewer than five calendar days to respond;
Treating an accounting variance as conclusive proof of fraud;
Relying on unauthenticated screenshots or second-hand accusations;
Ignoring evidence that another person used shared credentials;
Charging one offense but dismissing the employee for another;
Using preventive suspension without a serious and imminent threat;
Extending unpaid suspension beyond 30 days;
Disclosing allegations to people with no need to know;
Forcing a resignation or confession; or
Withholding pay or deducting an alleged loss without legal basis.

Mistakes by employees

Ignoring the notice because the accusation seems vague or unfair;
Responding only through an emotional verbal denial;
Missing the deadline without requesting an extension;
Deleting messages, changing files, or contacting witnesses to align stories;
Signing minutes or admissions without reading them;
Taking confidential records beyond what is lawfully permitted; or
Assuming that resignation automatically ends the investigation or related liability.

When legal help is urgent

Prompt advice from a Philippine labor lawyer is advisable when:

Dismissal or preventive suspension is imminent;
The notice gives an unreasonably short response period;
The alleged loss or potential criminal exposure is substantial;
Records may be deleted, overwritten, or altered;
The case involves regulated financial, tax, health, government, or personal data;
The employee is a union officer or alleges retaliation, discrimination, or whistleblower reprisal;
Management is demanding a confession, repayment, resignation, or waiver;
A criminal complaint, subpoena, search, or regulator report is contemplated; or
The employee has already been dismissed and needs to assess filing deadlines and remedies.

An employee disputing dismissal may seek assistance through the Department of Labor and Employment’s Single Entry Approach and, where unresolved and within jurisdiction, pursue an illegal-dismissal complaint before the appropriate labor tribunal. Because jurisdiction and filing strategy depend on the parties and claims, obtain advice promptly rather than waiting for records or memories to disappear.

Frequently asked questions

Can an employee be dismissed immediately after falsification is discovered?

Ordinarily, no. Even apparently strong evidence does not dispense with the first notice, reasonable opportunity to answer, fair consideration of the defense, and written decision. Immediate access restrictions may be appropriate for security, but they are not a substitute for due process.

Is five calendar days always enough?

Five calendar days is the minimum generally recognized as a reasonable opportunity to answer a just-cause charge. More time may be necessary when the case is complex, records are extensive, the employee lacks access to relevant materials, or illness or another justified circumstance prevents a meaningful response.

Is an actual hearing mandatory?

Not in every case. The essential requirement is a meaningful opportunity to be heard. A conference or hearing should be provided when requested in writing, required by company or collective-bargaining rules, or necessary because substantial evidentiary disputes cannot fairly be resolved through written submissions alone.

Does refusing to sign the notice stop the process?

No. Refusal to acknowledge receipt does not invalidate a properly documented service. A signature may acknowledge receipt without admitting the allegations; the employee may write “received only” with the date and time.

Can an employer rely on CCTV, email, or system logs?

Potentially, yes, if the material was lawfully obtained, relevant, preserved, and sufficiently reliable. Its weight depends on authentication, completeness, access controls, context, and whether the employee had an opportunity to challenge it.

Must the employer prove the exact amount lost?

Not always. A proven intentional breach of trust may be serious even if the employer prevents the loss or cannot quantify it precisely. However, an unsupported estimate should not be presented as established damage, and the underlying misconduct must still be proven.

Is dismissal automatically valid because the handbook lists falsification as a dismissible offense?

No. The employer must still prove that the employee committed the defined offense, that the rule was applicable and properly communicated, and that due process was observed. The surrounding circumstances and consistent application of the rule remain relevant.

What happens if there was valid cause but defective procedure?

A valid just cause may prevent reinstatement even when procedural due process was defective, but the employer may be liable for nominal damages. In Agabon v. NLRC, the Supreme Court awarded ₱30,000 for a just-cause dismissal implemented without the required statutory process. The result in any case depends on the established facts and governing jurisprudence.

What if the evidence does not establish a just cause?

A dismissal unsupported by substantial evidence may be illegal, potentially leading to reinstatement, back wages, or other relief under applicable law. Procedural compliance cannot cure the absence of a valid substantive ground.

Official references

This article provides general legal information, not advice for a particular investigation or employment dispute. Outcomes depend on the evidence, employment documents, company or collective-bargaining rules, and current law. Official sources were checked as of 28 August 2026.