When a fake engineer certified 30 Boeing 747s, and what aviation did about it

Real cases of aviation credential fraud

There is a fundamental assumption in aviation, that most passengers never think about:

That the person certifying an aircraft to fly is properly trained, licensed, and verified.

It is an assumption the entire industry depends on. And history has shown, including in Australia, that it is an assumption which has been deliberately exploited.

Not because aviation lacks regulation, but because modern aviation is built on something more complicated than many people realise: a layered system of oversight, documentation, trust, and human verification. In a paper-based era, that system had gaps a determined individual could find and exploit.

What an aircraft engineer actually signs for

Most people are familiar with pilots. Far fewer understand the responsibility carried by a licensed aircraft maintenance engineer (LAME).

When a licensed engineer signs a maintenance release or certifies completed work, they are effectively stating:

• the maintenance was performed correctly, in accordance with approved documentation

• the aircraft meets all applicable regulatory requirements

• the aircraft is safe to return to service

That signature is not a formality, it carries legal weight, professional accountability, and direct safety consequences for every passenger who boards that aircraft. Which is precisely why falsifying the credentials behind it is treated by courts as a serious criminal act.

The Sydney case that put an unqualified engineer in front of 30 Boeing 747s

The most significant Australian case on record is also one of the most brazen.

Between approximately late 2006 and July 2007, Timothy McCormack posed as a licensed aircraft maintenance engineer at Sydney Airport, working on aircraft without holding a valid CASA licence or the qualifications that came with it.

McCormack was not a licensed engineer. He forged his qualifications entirely, producing a falsified maintenance engineer's licence and ten fake CASA exam result documents. When unwittingly a supervisor, concerned he was not being paid enough for the senior work he was performing, asked him to produce his credentials.

By the time he was exposed in July 2007, McCormack had conducted 30 maintenance checks on Boeing 747 aircraft, including supervising and certifying the work of junior engineers beneath him. The NSW District Court was unambiguous about the implications.

Prosecutor Paul McGuire argued the deception created the potential for catastrophic safety consequences, and Judge Mark Marien noted that an estimated 12,000 people had been placed at risk. McCormack pleaded guilty to 42 charges, including forging a maintenance engineer's licence and performing unauthorised maintenance work on aircraft. He was sentenced to three years and five months in prison.

He then submitted four forged character references to the court during sentencing proceedings, including one claiming he had starred in and won a "Best and Fairest" award in an Australian Rules competition that did not exist. A second judge extended his sentence by a further eight months for attempting to pervert the course of justice.

The McCormack case is not a story about a sophisticated criminal exploiting a complex digital system. It is a story of its time, about paper documents, a face-to-face hiring process, and a verification gap that allowed an unqualified individual to certify airworthiness for nearly nine months.

The same pattern, replicated internationally

The McCormack case is unusual in its audacity but not in its mechanism. Similar cases have occurred in multiple countries.

United States. Michael Sandic pleaded guilty in a US District Court in Phoenix to falsifying his aircraft mechanic certificate, presenting the document to four separate companies in Arizona and falsely claiming airframe and powerplant ratings when applying for positions at British Aerospace Systems and Lockheed Martin. He was sentenced to two years in prison and permanently barred from employment in the airline and aircraft maintenance industries.

And the fraud is not limited to Engineers, the following examples detail pilots who have deceived employers.

Sweden / Europe. Thomas Salme spent 13 years flying commercial passenger aircraft without ever holding a valid commercial pilot's licence. Beginning in 1997, Salme, who had worked as a maintenance engineer for SAS, applied to Italian carrier Air One as a co-pilot using forged papers. He was eventually promoted to captain. He flew for multiple European carriers, accumulating 10,000 hours in the air, before being arrested at Amsterdam's Schiphol Airport in March 2010, whilst seated in the cockpit of a Boeing 737 carrying 101 passengers, moments before departure. He was fined €2,000 and banned from flying for 12 months.

South Africa. A South African agricultural pilot was sentenced to five years imprisonment after falsifying a US FAA private pilot's licence to make it appear as a commercial pilot's licence, then presenting it to the South African Civil Aviation Authority for validation. A SACAA inspector suspected the document and contacted the FAA directly, which confirmed no commercial licence had ever been issued to the individual.

The common thread: paper systems and verification gaps

Across all of these cases, the fraud itself was not technically advanced.

No system was hacked. No database was breached. The tools were falsified paper documents, forged signatures, and fabricated exam results, the kind of records that, in a paper-based environment, depend entirely on someone picking up the phone to verify them.

In the McCormack case, that verification call was only triggered when a supervisor noticed a pay discrepancy, not driven from a compliance audit or a random licence validation check.

A simple pay query.

The lesson the industry drew from these cases was structural: verification cannot be triggered only by anomalies that happen to surface. It must be systematic, documented, and independent of the normal employment workflow.

The supply chain variant: when the fraud moves upstream

More recently, the same principle, falsified documentation exploiting verification gaps, surfaced in a different form and at a far larger scale.

Between January 2019 and July 2023, UK-based parts trader AOG Technics supplied over 60,000 aircraft engine components, primarily for the CFM56 engine powering Boeing 737s and Airbus A320s, accompanied by forged Authorised Release Certificates (ARCs). The ARCs were produced on the director's home computer in Surrey, with fabricated employee identities and falsified original equipment manufacturer purchase orders.

The fraud was uncovered in 2023 when a technician at TAP Air Portugal suspected a part did not fit correctly, triggering an investigation that eventually reached Safran and GE Aerospace. Regulators including the UK CAA, FAA, and EASA issued global safety alerts. Up to 96 aircraft worldwide were found to have been fitted with AOG Technics parts. Airlines including American Airlines, Ethiopian Airlines and Ryanair were among those affected.

Estimated industry losses exceeded £39 million.

Jose Alejandro Zamora Yrala pleaded guilty to fraudulent trading in December 2025 and was sentenced at Southwark Crown Court in February 2026 to four years and eight months in prison. The mechanism was identical to McCormack's, just applied to parts documentation rather than personal credentials.

Paper-equivalent certificates. Forged identities. Verification that relied on trust rather than independent confirmation, until someone noticed something didn't fit.

How the industry responded

Aviation's strength has always been its capacity to learn systematically from failure, including failures it finds uncomfortable.

In the wake of cases like McCormack's, regulators and operators tightened licence validation processes significantly. CASA, like its international counterparts, moved toward direct regulator-to-regulator verification, improved training traceability, and stronger internal compliance functions.

Modern Part 145 and CAMO environments now typically require:

• independent verification of licences with the issuing authority

• documented confirmation of type ratings and continuation training

• recurrent auditing of authorisation registers

• separation of the hiring function from the compliance verification function

• Improved digital technologies for tracking licensing

The AOG Technics case is driving equivalent reform in parts documentation, with EASA and the FAA pushing hard for digital ARCs with encryption and digital signatures that cannot be replicated on a home computer.

The next challenge may not look like the last one

The historical fraud cases share a common characteristic: they exploited paper-based systems in environments where verification was manual, intermittent, and trust-dependent.

The aviation industry has largely closed those gaps for physical documents. But as records move digital, remote onboarding becomes standard, and international contracting accelerates, new questions are emerging around cyber integrity, AI-generated document fraud, and cross-border credential data reliability.

The tools available to a determined individual in 2026 are considerably more sophisticated than a photocopier and a forged signature. Aviation's verification systems will need to keep pace, not because the industry is complacent, but because it has always understood that the threat evolves, and the response must evolve with it.

Aviation has never relied on blind trust

The existence of these cases does not suggest aviation is unsafe. The opposite argument is more defensible.

Aviation is one of the few industries that systematically assumes human error, procedural drift, and deliberate deception can occur and builds layers of defence around all of them.

McCormack was caught. Sandic was caught. Zamora was caught.

The fact that credential fraud in aviation remains rare, and that perpetrators are consistently prosecuted, is evidence that those layers largely work. But aviation's safety culture has never been built on the assumption that people are trustworthy.

It has been built on the requirement to verify that they are.

For more aviation maintenance compliance analysis, industry insights, and articles contact Craig Reid at support@jotoreaviation.au