The Framer on Your Roof Bought His Safety Card Online. Nobody Requires Him to Prove Otherwise.

In March 2019, a compliance monitor at New York’s Javits Center expansion project flagged a construction worker’s OSHA card. It looked right. Correct format, correct logo, laminated, tucked into a wallet alongside a union card and a transit pass. But when the monitor ran the card number against OSHA’s authorized trainer list, nothing came back.

That single fake card led investigators to a full-blown counterfeit document operation. Pedro Vasquez sold the cards from the Bronx. Michael Kruise Williams manufactured them alongside fake driver’s licenses and Social Security cards. They advertised on social media. The New York State Inspector General’s investigation found OSHA cards were just one product in a catalog of counterfeit credentials, sold to workers who needed them to get on a job site by morning.

That was one operation in one borough. Five years later, the problem has gotten worse.

17,000 Fake Cards. One Company.

In April 2024, the NYC Department of Buildings deactivated 17,000 Site Safety Training cards after Valor Consulting’s senior executives were indicted for selling certification cards without providing any actual safety training. Not abbreviated training. Not poor-quality training. No training at all. Workers paid, received cards, and walked onto some of the most complex construction sites in New York City having never sat through a single hour of safety instruction.

Deputy Mayor Maria Torres-Springer called it “corporate greed and fraud.” DOB Commissioner Jimmy Oddo said Valor “put profits ahead of safety by allowing thousands of workers on to larger construction sites without the required life-saving safety training.” NYC’s Small Business Services scrambled to offer free retraining through Workforce1 Career Centers.

But consider what 17,000 means. NYC’s construction workforce is roughly 150,000 to 200,000 workers. One fraudulent training company compromised the credentials of somewhere between 8% and 11% of the entire workforce. And Valor was only caught because New York City happens to have one of the few mandatory site safety training programs in the country.

No Database. No Verification. No Problem.

OSHA’s own fact sheet on card fraud acknowledges “an increase in fraudulent activity related to these courses over the past several years.” But here is where the system breaks down in a way that should alarm anyone building a home: there is no centralized federal database to verify OSHA training cards.

A contractor’s license? You can look that up on your state licensing board’s website in two minutes. Workers’ compensation insurance? Your GC should have a certificate of insurance. But whether the framer on your second-story addition actually completed 10 hours of OSHA safety training, including fall protection and electrical hazard awareness? There is no system to check. OSHA publishes a list of authorized trainers. It does not publish a list of who those trainers actually trained.

Paper cards. No serial number database. No QR code linking to a verified record. In 2026.

Residential Construction: Where Enforcement Disappears

It gets worse for homeowners specifically. OSHA does not require the 10-hour or 30-hour Outreach Training courses at the federal level. New York City mandates site safety training on larger commercial projects through Local Law 196. A handful of other jurisdictions have similar requirements. But for the vast majority of residential construction across America, nobody is required to hold an OSHA card at all.

On a $700,000 custom home project with workers 25 feet in the air on roof trusses, there is no federal requirement that a single person on that site has completed any standardized safety training.

OSHA standards still apply. Fall protection is required above six feet. Electrical safety protocols are mandatory. Trenching rules exist. But the training that teaches workers what those rules mean and how to follow them? Optional. The Bureau of Labor Statistics reported a construction fatality rate of 12.9 per 100,000 full-time equivalent workers in 2023. More than 1,000 construction workers have died on the job every year since 2016, according to CPWR’s Construction Fatality Map. Falls account for more than a third of those deaths.

Some of those workers had training. Some had paper cards that said they did. Some had nothing. We cannot tell the difference because nobody built the system to track it.

AI Credential Platforms: A Fix That Needs a Mandate

BuilderFax, acquired by the AI workforce management company Lumber, is one attempt to build the verification layer that OSHA never created. Their free app lets construction workers store certifications and training records in a digital wallet. Employers can verify credentials instantly rather than trusting a laminated card.

Kirk Samuelson, a former senior vice president at Kiewit Corporation, founded BuilderFax to combine digital credential management with AI-driven workforce tools. Workers get automated renewal reminders. Employers get verified qualification data. On paper, it solves the problem.

In practice, it solves the problem for people who opt in. A fraudulent training company does not sign up for digital verification. A subcontractor sending untrained workers to your residential job site does not digitize their credentials. BuilderFax has not published adoption numbers. Neither has any competitor. Until verification is mandatory rather than voluntary, these tools serve the contractors who were already doing the right thing and miss the ones who were not.

What You Can Do Before Breaking Ground

If you are hiring a general contractor for a residential project, the credential gap is yours to close. Nobody else will do it for you.

Ask your GC how they verify subcontractor worker credentials. Most will tell you they rely on the subcontractor to handle it. That is the honest answer, and it means nobody is verifying anything. A good GC will at minimum require copies of OSHA 10-hour cards from all workers on site. A better one will verify those cards against the OSHA authorized trainer list.

Write it into your contract. Add a clause requiring all workers on your project to hold current OSHA 10-hour certification (OSHA 30-hour for supervisors) and to provide copies before starting work. This is not standard in residential contracts. Make it standard in yours.

Ask if they use digital credential management. If your builder or their subs use BuilderFax, Procore, or another digital credentialing platform, that is a meaningful signal. It means they have invested in verification infrastructure rather than trusting paper.

Verify your state’s requirements. Some states have training mandates that go beyond federal OSHA standards. California, New York, Massachusetts, and Connecticut have varying requirements. Know what your jurisdiction requires and whether your builder is exceeding it.

The Uncomfortable Math

I keep coming back to the Valor numbers. Seventeen thousand workers from one company in one city. OSHA acknowledges fraud is increasing but cannot quantify it nationally because there is no verification database to measure against. If 8-11% credential fraud is the baseline in a city with mandatory training laws and active enforcement, what does the rate look like in states with no training requirements and no enforcement mechanism?

Nobody knows. That is not a hedge. It is an indictment of the data infrastructure.

Limitations of This Analysis

Several things this reporting cannot establish: No reliable national estimate of fake OSHA card prevalence exists. We are extrapolating from one city with unusually strong enforcement. No study directly links credential fraud rates to construction injury or fatality rates, though the mechanism is obvious. BuilderFax and similar platforms do not publish adoption data, so we cannot assess how quickly digital verification is spreading. And OSHA’s inspection and enforcement data is heavily skewed toward commercial construction, meaning the residential picture is even murkier than the numbers suggest.

The Counterargument, Stated Honestly

Most residential construction does not legally require OSHA 10/30 cards. Many experienced framers, roofers, and electricians learned safety through years of on-the-job practice, not a classroom course. The argument from residential builders is that formal certification does not correlate strongly with safety outcomes, that a 20-year roofer without a card is safer than a first-year worker who sat through a 10-hour course last week.

There is truth in that. Experience matters. Muscle memory matters. But the argument assumes the experienced worker is actually experienced and the training gap only affects newcomers. Valor proved otherwise. Those 17,000 workers included people at every experience level. Some needed the training. Some may not have. All of them were documented as trained when they were not, and the system had no way to catch it until prosecutors got involved.

AI verification does not replace experience. But it closes the gap between what a credential claims and what actually happened in a training room. For the homeowner writing a $500,000 check for a house, that gap is worth closing.