A Garage, a Laptop, and 60,000 Fake Parts: How Aviation's Safety System Runs on Trust Alone
A man working from his garage in Surrey sold 60,000 counterfeit aircraft engine components to eight major airlines over five years, and the fraud only ended because one bolt wouldn't fit during routine maintenance in Portugal, according to the UK's Serious Fraud Office. The case exposes how aviation's cornerstone safety certification, the Authorised Release Certificate, operates as an honor system with no verification mechanism, allowing forged documents created on a home computer to pass as proof of airworthiness for parts installed in Boeing 737s and Airbus A320s carrying millions of passengers.
The Architecture of an Impossible Fraud
Jose Alejandro Zamora Yrala ran AOG Technics from his home in Virginia Water, a leafy suburb 25 miles southwest of London. Between January 2019 and December 2023, he supplied engine blades, bolts, and washers for CFM56 and CF6 engines, the workhorses powering the majority of the world's narrow-body commercial fleet, to Ryanair, American Airlines, United, Delta, Southwest, Ethiopian Airlines, TAP Air Portugal, and Virgin Australia, according to court documents filed at Southwark Crown Court.
The operation's staffing revealed its scale: Zamora Yrala, his wife, her brother, and the family nanny. Everyone else, the sales managers, quality control officers, supply chain coordinators listed in company documents, didn't exist. He invented them, prosecutors told the court.
What made the fraud possible wasn't sophisticated technology or insider access. It was the Authorised Release Certificate itself.
Paper Proof in a Digital Age
Every aircraft component that enters service carries an ARC, a document certifying the part meets airworthiness standards and comes from an approved source. Airlines trust them. Maintenance crews rely on them. Regulators accept them as proof. The system assumes the certificates are genuine because verifying them would require infrastructure the industry never built.
Zamora Yrala discovered this gap and exploited it with two methods, according to the Serious Fraud Office investigation. Some of his ARCs started as legitimate certificates, which he obtained from an airline technician accomplice and altered on his home computer. Others he created from scratch with help from a Spanish graphic designer. Both types circulated through the supply chain without challenge.
No database exists to check an ARC's authenticity. No cryptographic signatures protect the documents. No blockchain tracks a part's journey from manufacturer to installation. The aviation industry, an ecosystem that demands redundancy in every mechanical system, built its parts verification on a single point of failure: trust that the paper is real.
Zamora Yrala also fabricated provenance documents showing where AOG Technics supposedly obtained its inventory. Major airlines purchasing critical engine components never verified these claims. The system provided no mechanism to do so.
The Bolt That Broke the Chain
In 2023, a technician at a Portuguese airline attempted to install a bolt during routine engine maintenance. It wouldn't fit.
That single mismatched component triggered an investigation that unraveled the entire operation. On August 4, 2023, aviation safety agencies in the UK, US, and European Union issued simultaneous alerts, according to the UK Civil Aviation Authority. Hundreds of international flights grounded immediately as airlines searched their fleets for AOG Technics parts.
American Airlines found 28 engines affected, with losses reaching £21 million, according to figures cited in court. Industry-wide losses reached £39.3 million. The financial damage was calculable. The safety implications remain unknown because the origin of all 60,000 suspect parts has never been determined.
A Sentence That Doesn't Match the Scale
Zamora Yrala pleaded guilty to fraudulent trading at Southwark Crown Court in December 2024. In February 2025, he received four years and eight months in prison, less than half the maximum ten-year sentence for the offense, according to court records. He was also disqualified from serving as a company director for eight years and will face proceeds of crime proceedings.
The Serious Fraud Office completed its investigation in 19 months from raid to charges, a notably fast timeline for a case spanning five years and eight international airlines. Portuguese authorities continue their own investigation, having searched ten locations and made three arrests, according to statements from Portugal's Polícia Judiciária.
The sentencing left a question unanswered: What constitutes adequate accountability for a fraud that endangered passengers on thousands of flights daily across multiple continents? Zamora Yrala sold parts for £6.9 million that cost airlines £39.3 million to address, but the calculation of harm extends beyond financial losses to the unknowable, how many flights operated with components of uncertain origin, and what failures didn't happen only by chance?
Who Can Fix a System Built on Paper
The authority to reform aircraft parts certification is fragmented across multiple regulatory bodies with overlapping but distinct jurisdictions. In the United States, the Federal Aviation Administration sets airworthiness standards through its Parts Manufacturer Approval process and maintains the registry of approved suppliers. The European Union Aviation Safety Agency performs the same function for EU member states. The UK Civil Aviation Authority operates independently post-Brexit. Each agency can mandate changes to certification requirements within its territory, but international harmonization requires coordination through the International Civil Aviation Organization, a UN body where 193 member states must reach consensus on standards.
Airlines themselves hold significant leverage. The International Air Transport Association, representing 330 airlines carrying 83% of global air traffic, could establish industry-wide verification standards that exceed regulatory minimums. Major carriers like American, United, and Delta could require suppliers to use blockchain-verified digital certificates or participate in centralized authentication databases as a condition of doing business. When airlines demanded winglet retrofits for fuel efficiency in the 2000s, manufacturers responded within 18 months. The same purchasing power could drive certification reform, but it requires collective action across competitors who typically guard supply chain practices as proprietary information.
The technical infrastructure for digital verification already exists in adjacent industries. Pharmaceutical supply chains use serialization systems that track every pill from factory to pharmacy. Automotive manufacturers employ digital twins, virtual replicas of physical parts with complete provenance records. Adapting these systems to aviation parts would require upfront investment estimated in the hundreds of millions of dollars across the industry, plus ongoing maintenance costs and the complex process of integrating legacy systems with new verification platforms. The question isn't technical feasibility but who pays and who mandates adoption when the current system's failures remain invisible until a bolt doesn't fit.
What the System Still Doesn't Know
The fraud collapsed in August 2023, but the parts remain unaccounted for. Some were removed during the emergency inspections that grounded hundreds of flights. Others may still be installed, their true origin obscured by the same documentation system that allowed them to enter service.
Airlines continue to rely on ARCs because no alternative exists. The certificate-based verification model emerged from post-World War II efforts to regulate surplus aircraft parts flooding the market, an era when paper documentation represented the height of administrative technology.
Zamora Yrala's operation demonstrated that anyone with basic document editing skills can forge the industry's primary safety certification. The response has been prosecution, not systemic reform. The ARCs that airlines receive today are verified through the same non-existent process that allowed a garage operation to supply engine components for five years.
The counterfeit parts are still out there, somewhere in the supply chain, authenticated by documents that prove nothing except that the industry built its safety system on paper and called it certification.