Investigation
NYC Invalidates 2,000 Construction Safety Cards Tied to Alleged Training Fraud
Provider allegedly sold city-issued and OSHA credentials to workers who had not completed required course
New York City is moving to invalidate about 2,000 active construction worker safety credentials after prosecutors alleged an approved training company sold cards to workers who had not completed required courses.
RedCode Inc., owner Lutfur Rahman and employee Mohammed Tushar were arraigned Sept. 8 in Brooklyn Supreme Court on a 12-count indictment stemming from an undercover investigation by the city Dept. of Investigation. Prosecutors allege Rahman and Tushar agreed to provide Site Safety Training and OSHA cards for $500 each without requiring undercover investigators posing as construction workers to complete the courses.
RedCode operated from this Brooklyn office before New York City stopped the company from issuing new safety-training credentials in November 2025.
Image courtesy Google Maps
Investigators visited RedCode locations in Brooklyn and Queens between April 22 and July 16, 2025, and allegedly signed attendance sheets for classes they did not attend. RedCode then allegedly submitted records indicating the required training had been completed, resulting in issuance of the credentials, prosecutors said.
The city Dept. of Buildings independently found a similar irregularity during a July 26, 2025 audit at RedCode's 146-04 Hillside Ave. location in Queens. Auditors arrived for a scheduled two-hour Drug and Alcohol Awareness course, then a required part of the city's 40-hour SST program, but the class did not take place. The following month, DOB confirmed RedCode nevertheless had issued a completion certificate for the course, the department told ENR.
DOB denied RedCode's application to renew its status as an approved training provider in November 2025 based on findings that required training had not been provided, DOB Press Secretary Andrew Rudansky told ENR in an email. The company has not been authorized to issue new cards or certificates since then. RedCode had been approved since April 2021 and issued about 2,000 SST cards tied to more than 7,000 certificates.
“Additional investigation was needed before the Department could determine this was a [recurring] issue,” Rudansky said. DOB continued working with Brooklyn prosecutors as they built the criminal case and, following the indictment, moved to revoke RedCode's previously issued cards and certificates.
New York City requires at least 40 hours of approved safety training for workers at larger and more complex construction sites.
Image courtesy NYC Dept. of Buildings
Workers holding RedCode-issued cards, or cards from other providers that relied on RedCode certificates, have 90 days to complete required training and obtain replacement credentials. Their SST cards will continue to scan as active at jobsites during the grace period, although RedCode-issued certificates are being invalidated.
New York City requires workers at larger and more complex construction sites to complete at least 40 hours of safety training. DOB says more than 450,000 workers have received SST cards representing more than 18 million hours of training.
ENR has previously reported other investigations involving fraudulent or allegedly fraudulent safety credentials. In 2023, DOB invalidated about 6,000 cards issued by EHS Academy after an audit raised questions about whether required training occurred. Brooklyn prosecutors separately charged Odessa Safety and another provider after undercover investigators allegedly obtained credentials without attending classes.
A larger case followed in 2024. Manhattan prosecutors alleged Valor Security & Investigations falsely certified about 20,000 workers between 2019 and 2023, when it became the city's third-largest safety certifier. The case included Ivan Frias, who fell to his death from a construction site in 2022 after Valor allegedly certified him for training it had never provided.
RELATED
NY Construction Safety Firm Falsely Certified Workers, Says Manhattan DA
DOB subsequently disabled about 17,000 active Valor-issued SST cards and required affected workers to obtain legitimate training. When ENR asked whether the RedCode case prompted additional safeguards after the earlier cases, DOB did not identify new measures, instead citing its provider-audit program and work with prosecutors.
The RedCode defendants were released without bail and are due back in court Nov. 4. An indictment is an accusation, and the defendants are presumed innocent unless proven guilty.
Facts Only
* New York City is moving to invalidate about 2,000 active construction worker safety credentials.
* Prosecutors allege RedCode Inc. sold Site Safety Training and OSHA cards for $500 each without requiring course completion.
* RedCode operated from a Brooklyn office before the city stopped it from issuing new safety-training credentials in November 2025.
* Investigators allegedly signed attendance sheets for classes that did not occur and submitted records indicating training completion.
* The Department of Buildings found an irregularity during a July 26, 2025 audit at RedCode's Queens location where a required course was not held but a certificate was issued.
* The DOB denied RedCode’s application to renew its status as an approved training provider in November 2025 based on the findings of unprovided training.
* RedCode had been approved since April 2021 and issued about 2,000 SST cards tied to more than 7,000 certificates.
* Workers have 90 days to complete required training and obtain replacement credentials.
* New York City requires at least 40 hours of safety training for workers at larger construction sites.
* The Department of Buildings has disabled about 17,000 active Valor-issued SST cards following a previous investigation.
Executive Summary
New York City is moving to invalidate approximately 2,000 active construction worker safety credentials due to allegations that an approved training company sold certificates to workers who had not completed the required courses. Prosecutors allege that RedCode Inc. provided Site Safety Training and OSHA cards for $500 each without requiring undercover investigators posing as workers to complete the necessary training.
The Department of Buildings independently found irregularities, including an audit where a required Drug and Alcohol Awareness course was not held, yet the company issued a completion certificate. Following these findings, the DOB denied RedCode's application to renew its status as an approved training provider in November 2025, halting the issuance of new credentials.
Workers holding the invalidated RedCode cards or certificates have 90 days to complete the required training and obtain replacements; however, existing cards will remain active on job sites during this period. This action follows previous investigations into similar credentialing fraud involving other entities, such as EHS Academy and Valor Security & Investigations, resulting in the invalidation of thousands of safety cards across New York City.
Full Take
This situation highlights a systemic vulnerability where the infrastructure of safety certification is potentially exploited by entities operating under lax oversight, creating a direct threat to worker safety based on fabricated credentials. The pattern observed across multiple incidents—RedCode, EHS Academy, and Valor Security & Investigations—suggests that credentialing bodies, while attempting to enforce standards, are struggling against sophisticated fraud where procedural gaps allow for the issuance of documentation irrespective of actual training delivery. The fact that investigations require further assessment before determining if an issue is "recurring" suggests a challenge in establishing consistent administrative enforcement across disparate entities.
The implication for agency rests on the separation between the authorization body (DOB) and the executing entities (training providers). When external investigative bodies must intervene to correct actions already taken, it indicates that internal auditing mechanisms are insufficient against organized, high-volume credentialing schemes. The fact that invalidation is being implemented alongside a grace period acknowledges both the need for immediate remediation for workers and the complexity of retrospectively validating historical records.
The cost distribution seems uneven; while the process targets fraudulent providers like RedCode, the ultimate burden falls on the general pool of workers who rely on these certifications, often facing a gap in required training hours despite the bureaucratic timeline. Future resilience requires moving beyond reactive invalidation toward proactive, real-time credential verification systems that integrate audit results directly and immediately, rather than relying on retrospective investigations to establish liability for systemic failures.
Bridge Questions: What mechanisms can be established to create an immutable, real-time ledger for safety training completion that bypasses reliance on third-party self-reporting? How should regulatory bodies shift their enforcement focus from provider approval to continuous, in-situ verification of training delivery? If past investigations show patterns involving multiple providers, what unified protocol is necessary to address systemic credentialing fraud across the city?
Sentinel — Human
This text reads as a factual summary of an ongoing legal and regulatory investigation, characterized by precise detail and the citing of official bodies, making it highly characteristic of journalistic reporting.