Scams, fake internships & fraudulent “programs”
Students hunting for GSoC, Outreachy, Summer of Bitcoin, GSSoC, or hackathons are common targets. Real programs never charge you to apply and never ask for crypto wallet seeds.
Short checklist: stay-safe.md. Report new patterns via CONTRIBUTING.md (issue: scam pattern, not personal vendettas).
Golden rules
- Apply only on the official domain linked from the program’s own site (bookmark it — do not trust Google Ads).
- Never pay registration, “processing”, or “guaranteed selection” fees.
- Never share OTP, Aadhaar, passport scans, bank/UPI PIN, or crypto seed phrases.
- Stipends come after acceptance through official channels — not upfront “verification deposits”.
- If it sounds like a job but came from a random Telegram/WhatsApp group, treat it as fraud until verified on an official site.
Fake “open source program” scams
| Scam type | What they claim | Reality |
|---|---|---|
| Fake GSoC | “Register on our portal for guaranteed GSoC 2027” | GSoC is only summerofcode.withgoogle.com |
| Fake Outreachy | Paid form + “fast track” | Only outreachy.org |
| Fake Summer of Bitcoin | BTC “registration fee” or wallet connect | Only summerofbitcoin.org — stipend paid to you, not by you |
| Fake GSSoC / SSoC | Clone sites with similar logos | Use gssoc.girlscript.tech, socialsummerofcode.com — SSoC: only socialsummerofcode@gmail.com |
| Fake LFX / “Linux Foundation internship” | Email from @gmail.com “HR” |
Mentorships via mentorship.lfx.linuxfoundation.org |
| “Ambassador” / “Campus coordinator” fee | Pay to represent a famous program | Legitimate programs may have volunteers; they do not sell titles for cash |
Verify: URL in the address bar, HTTPS, and cross-link from the foundation’s main site (Google, LF, Conservancy, etc.).
Fake internship & job scams (general)
| Red flag | Why it’s suspicious |
|---|---|
| Pay for internship / kit / software | Real employers pay you, not the reverse |
| “Training + placement” ₹/X fee | Often unrelated to GSoC-style OSS; high pressure sales |
| Offer letter before any interview | Especially with urgent “accept in 24h” |
| Interview only on WhatsApp/Telegram | No verifiable company domain email |
| @gmail.com / @yahoo.com “recruiter” for big brands | Check careers page on company.com |
| Reshipping / “task” apps | Money mule / fraud — not internships |
| Copy-paste LinkedIn jobs | Same post for 50 “companies”; broken grammar + high pay |
Verify: Company careers portal, LinkedIn company page (blue check), and email domain @company.com.
Hackathon & capture-the-flag scams
- Event exists only as Instagram poster — no Devfolio / Devpost / MLH / Unstop / official college domain.
- Form asks for parent bank details, full Aadhaar, or copies of ID “for prizes”.
- “Winners must pay shipping/tax upfront.”
- Phishing “Devfolio login” pages — check URL is exactly
devfolio.co.
Phishing & impersonation
- Fake mentors: “I’m a GSoC mentor, send repo access / SSH key / cloud API key.” Real mentors work through public org channels after you apply officially.
- Fake GitHub org invites: Read org name carefully; typosquat (
summer-of-code-googlevs real org). - Wallet / Web3 “stipend”: Connect wallet to receive payment — drains wallet. Real SoB uses official onboarding after selection, not random DMs.
- PDF offer letters with only mobile numbers — no corporate letterhead verifiable online.
Social engineering patterns
- Urgency: “Last 3 slots — pay now.”
- Secrecy: “Don’t tell your college; exclusive deal.”
- Flattery + mismatch: “Selected from 1% talent” but zero technical screen.
- Moved off-platform: “Leave GitHub, work in this private repo only” before any verified program acceptance.
India-specific
| Resource | Use |
|---|---|
| Cyber Crime Portal | Report online fraud |
| 1930 | National cyber fraud helpline (verify current number on official site) |
| Campus IQAC / training & placement | Ask if offer is recognized before paying anyone |
| UPI chargeback limits | Act fast; save screenshots and UTR |
Legitimate Smart India Hackathon uses sih.gov.in — not .com lookalikes.
What real programs do not do
- Charge application fees (GSoC, Outreachy, ESoC, LFX, SoB, OSPP official flows).
- Ask for crypto seeds or “refundable security deposit” in USDT.
- Promise “100% selection” through a third-party “consultant”.
- Send stipend before you sign official paperwork / accept on the real portal.
- Run primary communication only in a private Telegram with no link from official site.
If you already paid or shared data
- Stop further payments; block the account.
- Bank/UPI: Call issuer fraud line immediately.
- Passwords: Rotate if you reused any; enable 2FA on GitHub, Google, email.
- Documents: If Aadhaar/PAN leaked, note on cybercrime report; watch for loan fraud alerts.
- Report: Official program (they track impersonation), platform (Telegram/WhatsApp where possible), cybercrime.gov.in.
- Warn others — issue/PR to this repo with pattern description (no doxxing).
Contribute scam patterns
Open a PR adding rows to this doc or an issue using template Report scam pattern:
- Pattern name (e.g. “Fake GSoC registration fee”)
- How it presents
- How to verify
- No naming random individuals without public legal conviction — focus on tactics
Official program contacts (bookmark)
| Program | Official site |
|---|---|
| GSoC | summerofcode.withgoogle.com |
| Outreachy | outreachy.org |
| Summer of Bitcoin | summerofbitcoin.org |
| LFX | mentorship.lfx.linuxfoundation.org |
| ESoC | esoc.dev |
| MLH Fellowship | fellowship.mlh.io |