When the Safety Card Is Real and the Training Never Happened
Pull a training roster off any jobsite in the country and you will find signatures, dates, a course title and a trainer's name. Now call the trainer. Almost nobody does. The document gets treated as the proof, when the document is only a claim about something that happened in a room somewhere. A criminal case out of Brooklyn is a useful reminder of what that claim is worth when nobody checks it.
What the Brooklyn case alleges
On September 8, 2026, the Kings County District Attorney announced that two men and a training company had been arraigned on an indictment tied to construction safety credentials. The defendants named in the release are Lutfur Rahman, 34, of Jamaica, Queens, Mohammed Tushar, 34, of Howard Beach, and Redcode Inc., which operated locations on McDonald Avenue in Brooklyn and Hillside Avenue in Queens.
The charges include first degree offering a false instrument for filing, second degree receiving reward for official misconduct, and second degree falsifying business records. Prosecutors allege that between April 22 and July 16 of 2025, investigators from the New York City Department of Investigation posing as construction workers obtained OSHA cards and New York City Site Safety Training cards for $500 each without attending any training, and that attendance records were falsified and filed.
According to reporting by Engineering News-Record, New York City is moving to invalidate roughly 2,000 active Site Safety Training credentials tied to the company, and workers holding them have 90 days to complete required training and obtain replacements. ENR also reports that those SST cards continue to scan as active at jobsites during the grace period. The city Department of Buildings had already denied the company's renewal application in November 2025 after finding required training had not been provided.
The card is not the requirement
An OSHA 10 or OSHA 30 card comes from the OSHA Outreach Training Program. That program is voluntary at the federal level. There is no provision in 29 CFR 1926 that says a construction worker must hold an OSHA 10 card. When a card is mandatory on your project, that requirement is coming from somewhere else: a state law, a city ordinance, an owner's contract, a union agreement, or a general contractor's own site rules. In New York City, the 40 hour Site Safety Training requirement for workers at larger and more complex sites comes from local law, not from federal OSHA.
What federal construction rules actually require is training. 29 CFR 1926.21(b)(2) puts the general duty on the employer to instruct each employee in the recognition and avoidance of unsafe conditions and the regulations applicable to the work. The hazard specific standards then each carry their own training provisions: 1926.503 for fall protection, 1926.454 for scaffolds, 1926.1427 for crane operator certification, and so on down the list.
So a card in a worker's wallet does not satisfy 1926.21 or any of the hazard specific provisions. Employer records showing that qualifying training was actually delivered do. If your compliance strategy is collecting card images, you have collected evidence of a purchase, not evidence of a program.
We wrote about a related version of this problem in how owners are using prequalification to sort contractors, where the documentation you hand over becomes the entire basis on which you are judged.
How to verify a training record without hiring anybody
Verification has a reputation as an administrative burden. In practice it is a few minutes per record, and it gets faster once it is a habit.
Check the card against the issuing system rather than against itself. For OSHA Outreach cards, the Department of Labor operates a card verification lookup. A card that cannot be found in the issuing system is not a card, it is a laminated rectangle.
Call the trainer listed on the roster. Not the training company's main line, the trainer. Ask what date the class ran, how long it ran, and how many people were in it. A real trainer answers those three questions without hesitating.
Compare the roster against payroll or timesheets for the same date. A worker who was on your site pouring concrete on the day he supposedly sat a 10 hour class did not sit the class. This single cross check catches most fabricated rosters and costs nothing.
Ask for the trainer's own authorization, not just the training company's. Outreach trainers are authorized individually and that authorization expires. Also check duration on its face: an OSHA 30 is 30 hours, so a course shown as completed in one day is wrong before you investigate anything.
Spot check the worker, not just the file. Ask a crew member what he learned. A worker who sat a real fall protection class can tell you what a personal fall arrest system is. A worker who bought a card cannot.
None of that requires a consultant. It requires treating the training file as something you audit rather than something you store.
What a contractor should do when a credential gets invalidated
Card revocations arrive with no warning and no regard for your schedule. If a batch of your workers' credentials gets pulled, this sequence limits the damage.
Identify exposure the same day. Run your training matrix against the issuing entity and the date range in question, not just against the affected workers you happen to know about.
Do not rely on the scanner. If the credential is administratively invalid but still scans, your gate system is now reporting a false positive and you need a manual list.
Get workers retrained rather than removed where you can. A worker defrauded by a training vendor is still your worker, and losing him to a paperwork problem helps nobody.
Document the remediation as it happens. If an inspection or an incident follows, the question will be what you knew and when you acted, and a dated log answers it.
Notify the owner or general contractor before they find out from somebody else. Self reporting a credential problem you are already fixing reads very differently from being caught with it.
Frequently asked questions
Does OSHA require an OSHA 10 card in construction?
No. The Outreach Training Program is voluntary under federal law. Card requirements on a given project come from state or local law, owner contracts, union agreements, or the general contractor. The federal requirement is training under 29 CFR 1926.21 and the hazard specific standards, and it is on the employer.
How do I verify an OSHA card is real?
Use the Department of Labor's Outreach card verification lookup for the card itself, then confirm the class independently by contacting the authorized trainer named on the roster and cross checking the training date against payroll for that worker.
Should training verification be part of subcontractor prequalification?
Yes, and most prequalification packages already ask for training documentation. The gap is that they ask for it and then nobody audits a sample of it. Verifying five records out of a submitted hundred costs an hour and tells you a great deal about the other ninety five.
Key Takeaways
A safety card is evidence that a credential was issued, not evidence that training was delivered. Those are different facts and only one of them satisfies a standard.
OSHA 10 and 30 cards are voluntary under federal law. Mandatory card requirements come from state or local law, owners, unions or general contractors, and federal training duties sit at 29 CFR 1926.21(b)(2) plus the hazard specific standards.
Cross checking a training roster against payroll for the same date is the cheapest fraud detection available and it takes minutes.
A credential can be administratively invalid and still scan as active at a jobsite gate, so a scanner result is not an audit.
If your prequalification process collects training documentation without ever sampling and verifying it, you are collecting paper rather than managing risk.
If your training matrix is green and you are not certain it would survive an audit, that is worth an afternoon. TriCore Safety builds written programs and training documentation that hold up when somebody actually checks them, and audits existing files to find the gaps before an inspector or an incident does. Start at tricoresafety.com.
Comments