Gen Z falls for online scams more than their boomer grandparents do

Temu is legitimately malware. The company had their source dumped and they obfuscated their malware-like practices to avoid Google's automatic detection. I presume they did the same with their iOS client. It is very telling that they have been extremely successful despite the same exact company and team doing this before with another app, Pinduoduo. That's right; same dev team and everything. Temu goes above and beyond the normal surveillance capitalism stuff we are used to and circumvents system security in order to sell your raw data on the market. The entire scheme isn't to build a retail space (although it is doing that as well); it is to get as many people to download the app so they can steal an absurd amount of data which is normally protected.

Referral codes aren't exactly uncommon for new apps, especially if VC money is involved.