What's to stop me^Wsomeone else and their friend from sponsoring each other for $5K to collect the $5K in matching funds?
Other than that, nothing. What's stopping you from conning an old lady out of her pension?
At the very least it's violating the terms of service. But very clearly the two of you would have conspired to defraud GitHub and in this case there would even be evidence in the form of an HN comment where you literally ask if this would work.
You may think you're clever but trust me when I tell you that no, you're not, and I've seen enough people try to be exceptionally clever and think "plausible deniability" would cover their butts and then get sued for fraud.
(A) two random developers that met each other at several conferences over the years, have contributed to a few same projects and really like the efforts the other one is putting into their OSS project
(B) two random developers that met each other at several conferences over the years, have contributed to a few same projects and want to fraud GitHub for the donation match
I think this could be a real practical problem for GitHub. And lawyering up against developers supporting the campaign potentially counteracts the marketing benefit of it.
Rather than waiting for some third party fans to give money, we'd be immediately rewarding the work that the other has done over the years with a one-off $5K (to maximize the match) contribution.
This feature really makes no sense, either they figure the fraud will be low enough to not matter, or there's some oversight mechanism to prevent it. I am certain they don't want to try to sue ten thousand random people to attempt to claw back $5k each. I imagine there's some flag/approval process.
I expect them to at least verify that you're doing some useful work on GitHub. If you are, I don't even particularly mind you exploiting this, even if it's perhaps not ideal.
AML: anti money-laundering.
Basics: