Another Indictment Involving Fake OSHA and DOB Site Safety Cards
On September 8, 2026, Brooklyn District Attorney Eric Gonzalez indicted Redcode Inc. and two Queens men, Lutfur Rahman and Mohammed Tushar, for selling OSHA and SST cards at $500 each to undercover investigators who never sat through the required coursework. The charges include first-degree offering a false instrument for filing, second-degree receiving reward for official misconduct, and second-degree falsifying business records. The defendants were released without bail and return to court on November 4, 2026.
DOB has invalidated roughly 2,000 active SST cards issued by Redcode. Holders have 90 days, until December 7, 2026, to complete legitimate 40-hour training and get replacement credentials, and the cards still scan as active in the meantime — which means a contractor can have untrained workers on site, passing the scanner, right up until the day they don't. On December 8, 2026, the cards are automatically revoked. This is the third such case after EHS Academy (6,000 cards, 2023) and Valor Security (17,000 cards, 2024). The Valor case ended with the conviction of a broker who distributed fraudulent OSHA certification cards to roughly 20,000 workers. One of them was killed at a Manhattan construction site.
The practical lesson for a contractor is uncomfortable. A card in a worker's wallet proves that a provider issued it, not that the worker was trained. Roughly 25,000 cards have now been pulled back for that reason. Verification cannot stop at the card. The worker who bought a fraudulent card is not the party DOB penalizes. Under Local Law 196, a violation for an untrained worker on site carries a civil penalty of up to $5,000 and is issued to three parties at once: the site owner, the permit holder, and the worker's employer. Failure to maintain the required training log carries a separate penalty of at least $2,500 — and a missing log supports a presumption that every worker on the site is untrained, which multiplies the first penalty across the roster.
What To Do Now?
Run an audit against your full roster now, not in late November when provider capacity is gone.
- Pull the certificates behind the card, not just the card. An SST card does not display the provider of each underlying course on its face. DOB's guidance is to contact a registered course provider, who can read the certificate history behind a card and identify which courses came from Redcode.
- Search wider than Redcode-branded cards. DOB is invalidating three further categories: SST cards issued by other providers that relied on Redcode certificates, Redcode certificates used for worker or licensing requirements, and any OSHA card listing instructor SM Lutfur Rahman. A worker can be affected without ever having heard the name Redcode.
- Check licensing certificates, not only site cards. Redcode certificates submitted toward a license application fall within the invalidation.
- Book replacement training immediately. Affected workers must complete replacement coursework with a DOB-registered provider by December 7. Every firm in the city is drawing on the same providers for the same 90 days.
- Re-paper the Local Law 196 log. Record the new certificate numbers, dates, and issuing provider. Keep the superseded entries; do not overwrite them.
- Put the same demand to your subcontractors in writing. Ask for a signed certification that they have run the Redcode check across their own workforce, and hold it in the project file. Their untrained worker is your violation.
- Document the audit itself. A dated record showing what you checked and when is the difference between a lapse and a pattern if DOB or a plaintiff's counsel comes looking.
Two changes from Local Law 10 of 2026 belong in the same review. The 2-hour drug and alcohol awareness course has been replaced by a course covering mental health and wellness, suicide risk and prevention, and substance misuse; since August 2026 only the new course counts toward card issuance, though workers holding active cards are not required to retrain. And cards expiring on or after May 3, 2026 now carry a full year from expiration to renew — but an expired card still cannot be used on a jobsite during that year. Treat the renewal window as a paperwork extension, never as site access.
If you have any question, please reach out to Lorraine D’Angelo, LDA Compliance Consulting, Inc., (914) 548-6369 or lorraine@LDAComplianceconsulting.com.