Remote Employee Time Theft Termination: PH Employer Rules

Time theft by a remote employee is usually a records problem before it is a discipline problem: the timesheet says eight hours, but the VPN, the ticketing tool or the client’s portal says three. Under the Labor Code, deliberately falsifying hours to get paid for work not done can support dismissal for serious misconduct or fraud under Article 297 [282], but only if your proof came from monitoring the employee knew about.^[1][4]

Work-from-home cases fail in two places: evidence from a tracker that was never disclosed in policy, and treating 40 idle minutes as proof of fraud. Here is how to build a case that survives both a Labor Arbiter and a Data Privacy Act complaint.

Direct Answer

An employer may dismiss a remote employee for time theft when substantial evidence shows the employee knowingly logged or claimed hours not actually worked, such as padded overtime, shared logins or timesheets covering hours spent on another job. Charge it as serious misconduct or fraud under Article 297 [282](a) or (c), rely only on monitoring disclosed in a written policy as the Data Privacy Act requires, serve a Notice to Explain with at least five calendar days to answer, hold a conference, and issue a written decision.^[1][4][7]

Key Takeaways

Time theft is dishonesty about work hours. The Supreme Court treats recording time as work-related conduct.^[5]
Rank-and-file staff are usually charged with serious misconduct; supervisors, team leads and timekeepers can also be charged with willful breach of trust.^[1][5]
RA 11165 and its IRR give telecommuting employees the same pay, overtime and appraisal rules as on-site staff, so attendance rules can be enforced if communicated.^[2][3]
Monitoring data is personal data. Use only tools disclosed in your policy and proportionate to the purpose.^[4]
A valid ground with no twin notices still costs the employer nominal damages.^[6]
Do not deduct the overpaid hours from wages or final pay without legal basis or written authorization.^[1]

Legal Basis

Authority	Classification	Rule Supported	Effect
Labor Code, Art. 297 [282](a), (c) and (e)	Statute	Just causes include serious misconduct, fraud or willful breach of trust, and analogous causes	The grounds for dismissing an employee who falsifies hours
Labor Code, Art. 292(b) [277(b)]	Statute	Written notice of the charge and an ample opportunity to be heard	Procedural due process before dismissal
Labor Code, Art. 113	Statute	Wage deductions only in cases allowed by law or regulation, or with written authorization	Limits recovering padded hours through payroll
RA 11165, Secs. 4 and 5	Statute	Telecommuting terms must cover compensable hours, minimum hours, overtime and rest days; same workload and appraisal standards as on-site staff	Attendance rules can be set and enforced for remote staff
RA 11165, Sec. 6	Statute	Employer must protect data and inform telecommuting staff of data protection rules; the Data Privacy Act applies suppletorily	Frames how monitoring data is handled
RA 10173, Secs. 11, 12(f) and 16	Statute	Transparency, legitimate purpose and proportionality; legitimate interest as a lawful basis; right to be informed	Monitoring must be disclosed and proportionate
Alvarez v. Golden Tri Bloc, Inc., G.R. No. 202158 (2013)	Supreme Court decision	Having someone else punch one’s time card is work-related dishonesty; repeated offenses show willful intent	Supports dismissal for falsified time records
King of Kings Transport v. Mamac, G.R. No. 166208 (2007)	Supreme Court decision	First notice must state specific facts and give at least five calendar days to answer	Sets the content of the NTE

What Counts as Time Theft in a Remote Setup

“Time theft” is not a Labor Code term. What matters is the specific act and whether it was deliberate. In a work-from-home arrangement under RA 11165 and DOLE’s implementing rules^[3], the usual patterns are:

Padded timesheets. Logging a full shift when system activity shows the employee started at 11:00 AM instead of 8:00 AM.
Overtime that never happened. Claiming two hours of overtime with no tickets, calls, commits or messages in that window. Remote staff are entitled to overtime pay like on-site staff, which is why padded overtime is real money.^[2]
Shared logins or proxy clock-ins. A sibling or friend keeps the account active, or a colleague logs in on the employee’s behalf. This is the remote version of the time card case in Alvarez.^[5]
Paid hours spent on another job. Working a second client’s shift during hours billed to you. A sideline outside paid hours is a different issue.
Activity faking. Mouse jigglers, auto-clickers or scripts that keep the status green while the employee is away.

Separate these from honest gaps. Brownouts and ISP outages are common in provincial WFH setups. An employee who reported the outage in the team chat has not committed time theft; one who stayed silent and claimed the full shift may have.

Choosing the Right Article 297 Ground

Serious misconduct for rank-and-file remote staff

Most remote employees are rank-and-file: CSRs, virtual assistants, developers, content moderators. For them, the stronger charge is usually serious misconduct under Article 297 [282](a). Knowingly claiming pay for hours not worked is a dishonest act connected to the job. In JR Hauling Services v. Solamo, the Supreme Court treated workers’ unauthorized side dealings with company goods as an act of dishonesty amounting to serious misconduct and breach of trust.^[6] See the elements of serious misconduct.

Fraud or willful breach of trust for leads and timekeepers

Team leads, supervisors, workforce analysts and anyone who approves or encodes hours hold a position of trust over time records. If one of them falsifies their own time or approves a subordinate’s padded hours, Article 297 [282](c) also fits. In Alvarez v. Golden Tri Bloc, an outlet supervisor who had a shift leader punch in his card was validly dismissed. The Court called the punching of a time card “undoubtedly work related” and held supervisors to a higher degree of honesty than ordinary rank-and-file staff.^[5] Our loss of trust and confidence guide explains the elements.

Proportionality still applies

A single 30-minute discrepancy from a new hire is a coaching or written-warning matter, not a dismissal. Dismissal becomes defensible when the falsification is deliberate, repeated or large, or when the employee was already warned. Alvarez applied the totality-of-infractions rule: the supervisor had been suspended in 2003 for the same conduct, and the repetition showed willful intent.^[5] Check your code of conduct and the proportionality rules for disciplinary penalties before choosing the penalty.

Monitoring Evidence and the Data Privacy Act

This is where remote cases differ most from office cases. Activity logs, screenshots and webcam captures are personal data. The Data Privacy Act requires processing to follow transparency, legitimate purpose and proportionality, and gives the employee the right to be informed that their data is being processed.^[4] RA 11165 separately makes the employer responsible for data protection and for informing telecommuting staff of the rules.^[2]

What a defensible monitoring setup looks like

A written telecommuting or IT-use policy, acknowledged by the employee, naming each tool, what it captures and why.
A privacy notice that lists attendance verification and disciplinary investigation as purposes.
Capture limited to work accounts and company devices, and to paid hours.
Access to monitoring data restricted to HR, WFM and the investigating officer.

In Pollo v. Constantino-David, the Supreme Court upheld a search of an office computer partly because a published computer-use policy told employees they had no expectation of privacy in the system.^[8] That was a government case, but the logic carries over to private employers. Constant webcam recording or capturing keystroke content on a personal laptop is harder to justify as proportionate. More on this in employer monitoring of remote workers and remote work and workplace privacy.

Remote Evidence That Holds Up

Labor tribunals require substantial evidence. For time theft, that means two or more independent records that contradict the timesheet. One source is rarely enough.

Evidence	What it proves	How to secure it
VPN, SSO or HRIS login and logout records	When the account actually connected	Export raw logs with timezone noted; keep IT’s export note
Ticketing, CRM or call-platform activity	Whether work was done in the claimed hours	Pull per-hour counts for each disputed date
Disclosed monitoring tool reports	Idle stretches, screenshots of non-work screens	Export only the disputed dates; confirm the tool was in the acknowledged policy
Chat and email timestamps	Presence, or silence, during claimed hours	Export from the company platform, not personal phones
Overtime requests and approvals	Who approved padded hours and on what basis	Pull the approval trail; check whether the approver verified output
IP address or device ID changes mid-shift	A second person or second device on the account	Have IT document the method; avoid tracking physical location beyond what policy discloses

Build a date-by-date comparison of claimed hours, logged hours and output. Fifteen shifts with a consistent 2- to 3-hour gap beat one dramatic Monday.

Worked peso example

Carlo, a remote support agent, earns ₱800 a day, so his hourly rate is ₱100. Over six weeks he claimed 24 hours of ordinary-day overtime that his ticket and VPN logs do not support. At 125%, that is ₱125 an hour, or ₱3,000 paid for work not done. Recover the ₱3,000 by a written agreement or a separate claim, not by unilateral deduction from his final pay.^[1]

Step-by-Step Procedure

Freeze the data. Ask IT to export and preserve logs for the disputed period before retention settings delete them.
Confirm the policy trail. Pull the signed telecommuting agreement, the IT-use policy and the privacy notice. If a tool is not covered, do not rely on it.
Build the comparison table. List every disputed shift with claimed hours, system hours and output.
Decide on preventive suspension. Use it only if continued access threatens records or systems, for up to 30 days. Revoking the employee’s system access is the usual remote equivalent. See preventive suspension rules.
Serve the Notice to Explain. State each date, the hours claimed versus logged, the company rule and the Article 297 [282] ground, and give at least five calendar days to answer.^[7] Send it to the official email and the address on file. See how a Notice to Explain works.
Hold the conference. A video call is acceptable if the employee can respond and bring a representative. See conducting the process by video call.
Test the defenses. Check claimed outages and approved offline tasks.
Issue the notice of decision. State that all circumstances were considered and the ground established, following the twin-notice rule.^[7]
Retrieve devices, then release final pay and the certificate of employment.

Common Employer Mistakes

Relying on an undisclosed tracker. Evidence from a tool the employee never knew about invites a Data Privacy Act complaint and weakens the labor case.^[4]
Treating idle time as fraud. Reading, calls and offline tasks show as idle. Prove that no work was done, not just that the mouse stopped.
Firing by chat message. Even with a valid ground, skipping the two notices exposes you to nominal damages, as in JR Hauling.^[6]
Vague NTEs. “You committed time theft” without dates and hours fails the specificity required by King of Kings.^[7]
Withholding the last salary to cover the loss. Wage deductions need legal basis or written authorization.^[1]

Frequently Asked Questions

Can I fire a work-from-home employee for falsifying timesheets?

Yes, if substantial evidence shows the falsification was deliberate and the penalty is proportionate. Charge it as serious misconduct or fraud under Article 297 [282] of the Labor Code, then follow the twin-notice process: a specific Notice to Explain, at least five calendar days to answer, a conference and a written decision. Repeated or large falsification is the strongest case for dismissal.

Is using a mouse jiggler grounds for dismissal?

It can be, if the employee used it to appear active while not working during paid hours and the company rules prohibit it. The device alone is not the offense. Prove the hours claimed but not worked through ticket, VPN or output logs, and confirm that your policy on activity status and attendance was communicated before the incidents.

Can I use screenshot or activity-tracking software as evidence?

Yes, if the employee was informed of the tool, its purpose and what it captures, and the monitoring is proportionate. The Data Privacy Act requires transparency, legitimate purpose and proportionality, and RA 11165 makes the employer responsible for data protection. Undisclosed or excessive monitoring weakens the evidence and can trigger a separate privacy complaint.

Is idle time on a monitoring tool enough to prove time theft?

Usually not. Idle readings also appear during calls, reading, meetings and approved offline work. Pair the idle data with independent records, such as ticket counts, chat silence and VPN logouts, across several dates. The Notice to Explain should list the specific dates and hours so the employee can answer each one.

Can I deduct the unearned pay from the employee’s final pay?

Not unilaterally. Article 113 of the Labor Code allows wage deductions only where the law or regulations permit them or the employee gives written authorization. Release the final pay due, then recover the overpayment through a written repayment agreement freely signed or a separate claim. Never make the release of final pay conditional on that agreement.

Does working a second job while on WFH count as time theft?

Only if the second job is done during hours paid by you. A sideline outside paid hours is governed by your conflict-of-interest and moonlighting rules, not time theft. If the employee billed you for hours spent on another client’s work, that is dishonesty about paid hours and can be charged under Article 297 [282].

What to Do Next

Today: have IT preserve VPN, HRIS and platform logs for the disputed period.
This week: confirm every source you plan to use is named in the signed telecommuting or IT-use policy and the privacy notice.
Before the NTE: finish the shift-by-shift comparison table and choose between serious misconduct and breach of trust based on the employee’s role.
For future cases: update the telecommuting policy to name each monitoring tool and the rule on activity-faking devices.

First action for HR: use the free Notice to Explain generator to prepare a time theft NTE for a remote employee, with the disputed dates, claimed versus logged hours, the Article 297 ground and the five-day deadline filled in, then download it as a PDF.

Sources and Legal Citations

Labor Code and Implementing Rules

[1] Presidential Decree No. 442, Labor Code of the Philippines, Articles 113, 277(b) and 282 (renumbered Articles 292(b) and 297), Lawphil. Supports: just causes, procedural due process, limits on wage deductions.

[2] Republic Act No. 11165, Telecommuting Act (December 20, 2018), Sections 3 to 6, Lawphil. Supports: telecommuting terms on hours and overtime, fair treatment, employer data protection duty.

[3] DOLE Department Order No. 202-19, Implementing Rules and Regulations of RA 11165, Department of Labor and Employment. Supports: implementing rules for telecommuting programs.

[4] Republic Act No. 10173, Data Privacy Act of 2012, Sections 11, 12 and 16, Lawphil. Supports: transparency, legitimate purpose and proportionality; legitimate interest basis; right to be informed.

Supreme Court Decisions

[5] Eric Alvarez, substituted by Elizabeth Alvarez-Casarejos v. Golden Tri Bloc, Inc. and Enrique Lee, G.R. No. 202158, September 25, 2013, Lawphil. Supports: time card falsification is work-related dishonesty; higher honesty standard for supervisors; totality of infractions.

[6] JR Hauling Services and Oscar Mapue v. Gavino L. Solamo, et al., G.R. No. 214294, September 30, 2020, Lawphil. Supports: dishonest acts as serious misconduct and breach of trust; nominal damages when notices are not served.

[7] King of Kings Transport, Inc., et al. v. Santiago O. Mamac, G.R. No. 166208, June 29, 2007, Lawphil. Supports: content of the first notice, five-calendar-day response period, conference and notice of decision.

[8] Briccio “Ricky” A. Pollo v. Chairperson Karina Constantino-David, et al., G.R. No. 181881, October 18, 2011, Lawphil. Supports: a disclosed computer-use policy negates a reasonable expectation of privacy in work computers.

Sources rechecked as of: November 11, 2026