NYC Voids 2,000 Safety Cards After Training Provider Fraud Indictment
New York City construction workers face a scramble to keep their jobsite credentials valid after Engineering News-Record reported the city is invalidating about 2,000 Site Safety Training cards tied to alleged training fraud at RedCode Inc.
RedCode, owner Lutfur Rahman, and employee Mohammed Tushar were arraigned September 8 in Brooklyn Supreme Court on a 12-count indictment. Prosecutors allege the pair agreed to sell Site Safety Training and OSHA cards for $500 each to undercover investigators posing as construction workers, without requiring them to complete the courses. The city Department of Investigation says investigators visited RedCode locations in Brooklyn and Queens between April 22 and July 16, 2025, and signed attendance sheets for classes they never attended, after which RedCode allegedly submitted records claiming the training had happened.
Market Impact
The city Department of Buildings independently flagged problems at RedCode’s Hillside Avenue location in Queens during a July 26, 2025 audit, when a scheduled two-hour Drug and Alcohol Awareness course, part of the mandatory 40-hour SST program, did not take place. DOB later confirmed RedCode issued a completion certificate for the course anyway. DOB denied RedCode’s renewal application in November 2025 and has since barred the company from issuing new cards or certificates. RedCode had been an approved provider since April 2021 and issued roughly 2,000 SST cards tied to more than 7,000 certificates.
This is not an isolated case. DOB invalidated about 6,000 cards from EHS Academy in 2023 after a similar audit, and in 2024 Manhattan prosecutors alleged Valor Security & Investigations falsely certified about 20,000 workers between 2019 and 2023, prompting DOB to disable roughly 17,000 Valor-issued cards. That case involved Ivan Frias, a worker who died in a 2022 fall after Valor allegedly certified him for training it never provided. Asked whether the RedCode case triggered new safeguards, DOB pointed only to its existing provider-audit program and ongoing cooperation with prosecutors.
What It Means for Subcontractors
- Workers holding RedCode-issued cards, or cards from other providers relying on RedCode certificates, have 90 days from the indictment to complete legitimate training and obtain replacement credentials.
- SST cards will keep scanning as active at jobsites during the 90-day grace period, but GCs should verify which workers hold RedCode-linked certificates now rather than waiting for a scan failure mid-project.
- Subs staffing NYC sites requiring the 40-hour SST program should confirm their training providers’ current DOB approval status directly, given that three providers (EHS Academy, Valor, and now RedCode) have had credentials mass-invalidated since 2023.
- Firms that used RedCode for OSHA cards, not just SST cards, should check whether those credentials are also affected, since prosecutors allege both card types were sold without training.
- Expect continued DOB audits of training providers; subcontractors relying on smaller or newer certifiers face added exposure if a provider loses its approval mid-contract, as RedCode did in November 2025.
