New York City is moving to invalidate about 2,000 active construction worker safety credentials after prosecutors alleged an approved training company sold cards to workers who hadn’t completed required courses.
RedCode Inc., owner Lutfur Rahman and employee Mohammed Tushar were arraigned Sept. 8 in Brooklyn Supreme Court on a 12-count indictment stemming from an undercover investigation by the city’s Department of Investigation. Prosecutors allege Rahman and Tushar agreed to provide the site safety training and OSHA cards for $500 each without requiring undercover investigators posing as construction workers to complete the courses.
RedCode operated out of this Brooklyn office before New York City barred the company from issuing new security training credentials in November 2025.
Image courtesy of Google Maps
Investigators visited RedCode locations in Brooklyn and Queens between April 22 and July 16, 2025, and allegedly signed attendance sheets for classes they did not attend. RedCode then allegedly submitted records indicating the required training had been completed, leading to the issuance of the credentials, prosecutors said.
The city’s Department of Buildings independently found a similar irregularity during a July 26, 2025, audit at the RedCode location at 146-04 Hillside Ave. in Queens. Auditors arrived for a scheduled two-hour drug and alcohol awareness course, then a mandatory part of the city’s 40-hour OSH program, but the class did not take place. The following month, the DOB confirmed that RedCode had nevertheless issued a course completion certificate, the department told ENR.
DOB denied RedCode’s request to renew its status as an approved training provider in November 2025 based on findings that required training had not been provided, DOB Press Secretary Andrew Rudansky told ENR in an email. Since then, the company has not been authorized to issue new cards or certificates. RedCode had been approved since April 2021 and issued about 2,000 OSH cards linked to more than 7,000 certificates.
“Further investigation was required before the Department could determine that it was a [recurring] The DOB continued to work with Brooklyn prosecutors as they built the criminal case and, after the indictment, moved to revoke RedCode’s previously issued cards and certificates.
New York City requires at least 40 hours of approved safety training for workers on larger and more complex construction sites.
Image courtesy of the New York Department of Buildings
Workers who have cards issued by RedCode, or cards from other providers that were based on RedCode’s certificates, have 90 days to complete the required training and obtain replacement credentials. Their SST cards will continue to scan as active at workplaces during the grace period, although certificates issued by RedCode are being invalidated.
New York City requires workers on larger and more complex construction sites to complete at least 40 hours of safety training. DOB says more than 450,000 workers have received OSH cards representing more than 18 million hours of training.
ENR has previously reported on other investigations involving fraudulent or suspected fraudulent security credentials. In 2023, the DOB invalidated about 6,000 cards issued by EHS Academy after an audit raised questions about whether the required training occurred. Brooklyn prosecutors separately charged Odessa Safety and another provider after undercover investigators allegedly obtained credentials without attending classes.
A larger case followed in 2024. Manhattan prosecutors alleged that Valor Security & Investigations falsely certified about 20,000 workers between 2019 and 2023, when it became the city’s third-largest security certification body. The case involved Ivan Frias, who fell to his death from a work in 2022 after Valor had certified him for training he had never provided.
RELATED
NY Construction Safety Firm Falsely Certified Workers, Manhattan DA Says
The DOB subsequently deactivated about 17,000 active SST cards issued by Valor and required affected workers to obtain legitimate training. When ENR asked whether the RedCode case prompted additional safeguards after previous cases, DOB did not identify new measures, instead citing its supplier audit program and its work with prosecutors.
The RedCode defendants were released without bail and are due back in court on November 4. An indictment is an accusation, and defendants are presumed innocent unless proven guilty.
