Cash App's parent company Block must pay up to $175 million after a CFPB crackdown on fraudulent transaction handling.