You receive a message claiming you won a lottery—but to ‘claim’ it, you're asked to pay taxes or share sensitive info. The prize never comes.