Scammers lure users with cashback offers that require clicking a link or installing an app—leading to data theft or financial loss.