By Joseph Andrade, Firefighter, Paramedic, Emergency Department and Vascular Access RN, OSHA Outreach Instructor, and Safety Officer. Founder and lead instructor at Life Saving Education.
Joseph is an active firefighter, paramedic, and registered nurse working in emergency and vascular access care, as well as an OSHA Outreach instructor and safety officer. He has spent his career on the response side of emergencies, from the fireground to the ambulance to the hospital bedside, and now trains civilians, workplaces, and first responders in the skills that save lives.
Imagine showing up to a New York City construction site with the cards the job requires. Your OSHA card looks legitimate. Your Site Safety Training card scans. Your employer lets you onto the site. The paperwork says you completed the training. But investigators later allege that you never sat through the required class at all.
That is the problem now unfolding in New York City. On September 8, 2026, the Brooklyn District Attorney, New York City Department of Investigation, and Department of Buildings announced an indictment involving RedCode Inc., a safety-training provider that operated in Brooklyn and Queens.
Prosecutors allege that undercover investigators were able to obtain OSHA and Site Safety Training cards for $500 each without completing the required training. The city then took an extraordinary step: DOB announced that approximately 2,000 active Site Safety Training cards issued by RedCode were being invalidated in the interest of public safety.
Workers did not create this system, and not every affected worker should be assumed to have knowingly participated in fraud. But the city now has to answer a much larger question: What happens when the credential looks valid but the safety education behind it cannot be trusted?
🔍 What Prosecutors Allege Happened
According to the Brooklyn District Attorney’s September 8 announcement, Department of Investigation personnel posed as construction workers between April 22 and July 16, 2025. Investigators allegedly visited RedCode locations in Brooklyn and Queens.
The DA says RedCode owner Lutfur Rahman and associate Mohammed Tushar agreed to provide the undercover investigators with OSHA and SST cards for $500 each without requiring them to complete the training. The undercover investigators were allegedly asked to sign attendance sheets so it would appear that they had attended the courses.
Prosecutors further allege that RedCode submitted information to DOB and to an OSHA-designated training intermediary stating that the students had completed training. According to the indictment announcement, that information resulted in OSHA course-completion cards and DOB SST cards being issued.
The defendants and company were charged with offenses including offering a false instrument for filing, receiving reward for official misconduct, and falsifying business records. Again, those are allegations. The criminal case will determine guilt or innocence. The safety issue is already real because DOB has acted on the training records.
🚨 Why DOB Invalidated the Cards
DOB announced that it was invalidating every SST certificate issued by RedCode and described roughly 2,000 active construction-industry cardholders as affected. The city did not simply tell employers to keep using the cards until the criminal case ends.
DOB also states that OSHA cards from RedCode owner and instructor SM Lutfur Rahman are no longer being accepted for NYC SST purposes. Workers whose SST cards were issued by another provider can also be affected if RedCode certificates were used to satisfy the training requirements behind that card. This is not only about cards with “RedCode” printed on the front. It can reach downstream into SST cards issued elsewhere when the supporting training record traces back to RedCode.
🧩 OSHA Card and SST Card Are Not the Same Thing
This story becomes confusing quickly because people often say “OSHA card” and “safety card” as if they are interchangeable. They are not.
OSHA 10 & OSHA 30
A federal course-completion card from OSHA’s Outreach Training Program. OSHA is clear this is not a professional certification or license, and does not replace an employer’s duty to provide task-specific training.
NYC Site Safety Training
A New York City Department of Buildings requirement, not a federal OSHA credential. Under Local Law 196, covered workers generally need 40 hours of approved training; supervisors need 62.
A common worker pathway includes an OSHA 30-hour course plus additional DOB-approved training. That means one training system can sit on top of another: federal OSHA Outreach course completion + NYC DOB Site Safety Training requirements = eligibility for an SST card when the full requirements are met. The September fraud case allegedly attacked both layers.
🏗️ What Training Does NYC Currently Require?
New York City’s SST system has continued to evolve in 2026. For a new worker card, one current pathway uses 30-Hour OSHA (or an approved equivalent), 8-Hour Fall Prevention, and 2-Hour Mental Health Awareness for the required 40 hours. Another pathway can start with OSHA 10 and combine additional DOB-approved courses to reach 40 hours. For supervisors, the required training package is larger and generally totals 62 hours.
The exact path matters because workers should not buy random safety classes and assume the hours automatically combine into a valid SST card. Use a DOB-registered course provider for SST courses and confirm that the provider is approved for the specific training being advertised.
🧠 New York also changed the SST curriculum this year
Local Law 10 of 2026 changed the SST program earlier this year. Effective May 3, 2026, New York City added mental-health and wellness, suicide-risk and prevention, and alcohol/substance-misuse topics to the SST framework. DOB later updated certain card-renewal pathways so a 2-Hour Mental Health Awareness course can be used. Beginning August 1, the 2-Hour Drug and Alcohol Awareness course was no longer being delivered as the SST option it had previously been. Local Law 10 also created a one-year renewal grace period for certain expired cards and recognized the 40-Hour Site Safety course as equivalent to OSHA 30 for purposes of new SST card issuance.
These are separate developments from the RedCode allegations. They matter together because they show that NYC construction-training compliance is not static. A worker or employer relying on a checklist from two years ago can be wrong even when the training provider is legitimate.
📱 A Card That Scans Is Better Than One That Can’t Be Checked, but Scanning Isn’t the Whole Answer
New York City’s Training Connect system gives employers and site-safety professionals a way to validate SST cards. DOB requires registered course providers to use Training Connect to manage SST records and issue official SST cards. The public can use the Training Connect phone app to validate cards. That is a major improvement over an entirely paper-based system.
But the RedCode case exposes the difference between record verification and training integrity. A database can verify that a record exists. It cannot automatically prove that the student sat in the classroom, completed the required contact hours, participated in required activities, or received competent instruction. If false attendance information enters the system at the front end, the downstream credential can still appear legitimate. That is why safety-training quality cannot be reduced to scanning a QR code.
🧑🏫 OSHA Outreach trainers have their own rules
OSHA-authorized Outreach trainers are not OSHA employees. They are independent trainers authorized through the OSHA Outreach Training Program. OSHA requires students to complete the entire course, including required topics and minimum contact hours, before receiving a course-completion card. OSHA also requires trainers to maintain records and can investigate misconduct, with corrective action ranging up to suspension or revocation of a trainer’s authorization. OSHA maintains an Outreach Trainer Watch List for trainers whose status has been suspended or revoked.
For students, OSHA recommends checking a prospective trainer’s current Authorized Trainer card, which shows the trainer’s name, authorization expiration date, and Authorizing Training Organization. One important limitation: OSHA says it does not operate or recognize a national public database that verifies every paper or plastic Outreach card. Verification often depends on the trainer and the records maintained by the trainer or authorizing organization.
💵 The “$500 and No Class” Problem Is Bigger Than Paperwork
The alleged scheme matters because the required training is supposed to change worker behavior. OSHA 30 is not supposed to be a card-purchasing transaction. Site Safety Training is not supposed to be a badge that unlocks a turnstile. Construction workers are expected to learn about hazards that can kill them or the people working beside them: fall protection, electrical hazards, struck-by hazards, caught-in/between hazards, site-specific safety systems, and mental-health and substance-misuse awareness in the updated NYC program.
👷 What Affected Workers Should Do Now
Workers who believe their SST card or supporting certificates are connected to RedCode should not wait until December.
🏢 What Employers and General Contractors Should Do
Employers should not treat this as only a worker problem. A worker may have taken what appeared to be a legitimate course from a provider that was operating openly. Site safety depends on employer verification systems too.
- Identify affected workers. Determine whether any current employees, subcontractors, or site personnel have RedCode-issued SST cards or supporting RedCode certificates.
- Do not wait for cards to fail at the gate. The 90-day grace period is intended to give workers time to retrain. Use it.
- Validate SST cards. Use DOB Training Connect and follow current DOB instructions.
- Review training-provider approval. Confirm that SST courses come from DOB-registered course providers approved for those courses.
- Review OSHA trainer authorization. Ask for the authorized trainer card before contracting for OSHA 10 or OSHA 30 training.
- Watch for impossible schedules. A 30-hour course should not somehow be completed in a couple of hours.
- Audit subcontractor onboarding. If subcontractors provide worker training documentation, the controlling employer should still know how credentials are checked.
- Train supervisors on the difference between OSHA and SST. A valid OSHA 30 card is not automatically a complete NYC SST credential, and a valid SST card does not eliminate the employer’s obligation to provide hazard-specific training.
🚩 Red Flags When Choosing a Training Provider
- A card without attending the full course
- Dramatically shortened “30-hour” training
- Guaranteed cards regardless of participation
- Cash-only deals without normal records
- An OSHA “certification” that OSHA does not actually issue
- Instant SST cards without the required underlying courses
- Training from someone who will not show current trainer authorization
A professional provider should be able to explain exactly what program is being delivered, who authorizes the trainer, what the student must complete, what card or certificate will be issued, whether the course satisfies a DOB requirement, and what it does not qualify the student to do.
⚖️ Who regulates what?
This scandal is a useful reminder that construction training involves several overlapping authorities. Federal OSHA controls the Outreach Training Program and authorizes Outreach trainers. The OSHA-authorized trainer / Authorizing Training Organization delivers the course and processes completion-card records. NYC Department of Buildings regulates the SST program, registers course providers, and maintains Training Connect. Employers still have the legal responsibility to provide required hazard-specific training under applicable OSHA standards. No single card transfers all of those responsibilities to somebody else.
🗽 Is This Only a New York Problem?
The criminal case is specific to New York City. The underlying lesson is national. OSHA itself warns about fraudulent Outreach activity and publishes guidance on avoiding card fraud. Workers across the country may encounter people advertising fast cards, fake cards, unauthorized training, or programs that misuse OSHA’s name.
New York is unusual because its SST system makes OSHA Outreach training part of a larger local credential framework. That makes the consequences especially visible. A questionable OSHA course can contaminate the validity of another credential built on top of it.
🧭 What Life Saving Education Should Take From This
For LSE, this is a strong argument for being extremely clear about course identity: say OSHA 10-Hour Outreach or OSHA 30-Hour Outreach, do not call the student course-completion card a professional certification or license, be clear about whether a course is Construction or General Industry, maintain current trainer authorization, maintain accurate records, and never imply that an LSE OSHA card automatically equals NYC SST unless the student separately satisfies current DOB requirements.
NYC Site Safety Training is one of the more logical specialty expansions for an East Coast training company already offering OSHA Outreach, but it should be approached as a real regulatory product, not simply a marketing page. To deliver and advertise NYC SST courses, LSE would need to satisfy current NYC DOB requirements for a Registered Course Provider and obtain approval for the specific SST courses it plans to offer. LSE’s existing OSHA 10/30 capability gives the business a natural foundation. It does not by itself make LSE an NYC SST provider. That distinction is exactly what this entire scandal is about.
✅ Key Takeaways
- RedCode Inc. and two individuals were indicted on September 8, 2026 in an alleged scheme involving OSHA and NYC SST cards issued without required training.
- The allegations remain unproven unless established in court.
- NYC DOB says roughly 2,000 active RedCode-issued SST cards are affected.
- Affected workers have a 90-day grace period through December 7, 2026 to complete legitimate replacement training.
- DOB is no longer accepting OSHA cards from the named RedCode trainer for NYC SST purposes.
- OSHA 10/30 cards and NYC SST cards are different credentials governed by different systems.
- A valid OSHA Outreach card does not replace employer-required hazard-specific training.
- NYC’s SST program also changed in 2026 through Local Law 10, including mental-health-awareness content and updated renewal options.
- Workers and employers should verify both the OSHA trainer and the NYC DOB course provider.
- LSE could consider NYC SST as a future specialty expansion, but only after completing DOB provider registration and course approvals.
❓ Frequently Asked Questions
Were all RedCode workers accused of fraud?
No. The criminal allegations are directed at the defendants identified in the indictment. Affected workers should not automatically be assumed to have knowingly participated in fraud.
Are RedCode SST cards invalid right now?
DOB says RedCode SST certificates are being invalidated, while affected SST cards can remain active when scanned during the 90-day grace period. Workers must complete required replacement training by December 7, 2026.
Is an OSHA 30 card the same as an SST card?
No. OSHA 30 is a federal Outreach Training Program course-completion card. SST is a New York City DOB construction-training credential that can use OSHA 30 as part of the required training pathway.
Is OSHA 30 a certification?
No. OSHA says Outreach cards are course-completion cards, not certifications or licenses.
How can I check an OSHA trainer?
Ask to see the trainer’s current Authorized Trainer card. It should identify the trainer, expiration date, and Authorizing Training Organization. OSHA also maintains an Outreach Trainer Watch List for suspended and revoked trainers.
How can I check an NYC SST card?
NYC DOB provides the Training Connect app for SST card validation.
Can any OSHA trainer issue an NYC SST card?
No. OSHA-authorized trainers can deliver eligible OSHA Outreach courses within their authorization. NYC SST cards must be issued through DOB’s registered provider system after applicable SST requirements are satisfied.
Does LSE currently need a new course for this topic?
No new course is required to publish or support this article. LSE already offers OSHA Outreach training. NYC SST is a separate potential specialty expansion that should only be advertised after DOB registration and course approval.
Train With a Provider That Shows Its Work
Life Saving Education delivers real OSHA 10-Hour and OSHA 30-Hour Outreach training with current trainer authorization and accurate records, taught by instructors who work these jobs every day.
OSHA 10-Hour Training OSHA 30-Hour Training
Plan Group Training
📚 Sources and Further Reading
- NYC Department of Buildings: Fraudulent Construction Safety Training Provider Shut Down Following Multi-Agency Investigation, September 8, 2026
- Brooklyn District Attorney: Two Individuals and Company Indicted for Making and Selling Fake OSHA and Buildings Department Site Safety Cards, September 8, 2026
- NYC Department of Buildings: SST Card Information and RedCode Notice
- NYC Department of Buildings: Training Connect
- NYC Department of Buildings: Registered Course Provider Information
- OSHA: The Facts About Obtaining an OSHA Card
- OSHA: Outreach Training Program FAQs
- OSHA: Outreach Trainer Watch List
- Related reading: When Online Safety Training Is Not Enough: What Employers Must Know About OSHA, NASP, and AHA Skills Training
This article is educational and does not provide legal advice. NYC construction-training requirements can change. Workers and employers should verify current DOB and OSHA requirements before making training or credential decisions.
