You have essentially two ways to achieve that.
Calling an API
When the user claims that he finished the tasks on the third-party site, call the API of this site, asking to confirm that the tasks were already done. If we assume that you trust the third-party and the channel between you and the third-party server, this guarantees you that the user actually performed the required tasks.
Imagine the task is to store a given file on Google Drive, with a specific name. Once the user finishes the task, he comes back to your site/mobile application. Your site/mobile application can then use OAuth to match the Google's account to the user and, given specific authorization, access the file in Google Drive, or at least check that the file exists.
Trusting the user
If the first alternative couldn't be done, then you have to trust the user when he tells that he actually did the tasks.
You shouldn't necessarily ask the user if he did the tasks, with a yes/no option; instead, you can actually check the contents of the
<iframe> or check the URLs which were used by the
<iframe> (maybe http://example.com/task1/success means that the user finished the task, while http://example.com/task1/failure means that the user failed it?)
<iframe>; nevertheless, as soon as the code runs on client side, it can (and will, if there are benefits to do that) be tampered.
If you're sure you can trust your users, then you can address the actual technical aspects through StackOverflow. If you're able to make the third-party change their page, cross-document messaging would be the most easy and straightforward solution here (being also relatively easy to tamper for a user who wants to cheat).
Of course, if you have leverage over the third-party, you can develop a solution together, which also uses a private-public key pair to encrypt the data which passes through the user. The user becomes merely a transporter of the data, and can't tamper it. This being said, if you have this sort of power over the third party, why not asking them to do an API?
The user can claim that he did the tasks, even if he didn't. There is nothing you can do to completely prevent cheating here (unless you can exchange a pair of keys with the third-party).
The easiest solutions require to change the third-party website; if you have this sort of power, couldn't you simply ask the third-party to develop an API?
Before performing something on your site, the user needs to ask a few questions. There is a third-party service—a site which hosts questions and collects answers from the users (and verifies that the answers are correct).
You start by generating an UID that you encrypt with a public key which was previously provided by the third-party. Then, you redirect the user to the third-party site, specifying the encrypted UID in the URI; the user cannot read the UID, because he doesn't have the private key.
Once the user answers the questions, the third-party site redirects the user back to your site, and appends to the URI some data which contains the UID, as well as the success/failure status, encrypted with the second public key, the one you previously provided to the third-party. Once you receive this data, you can be sure that the user haven't tampered with it, even if he knew both public keys: since the user couldn't know the original UID, the presence of the authentic UID ensures that the message was encrypted by the third-party.
As you can see, there is nothing particularly complicated for someone who is familiar with cryptography, and there are plenty of risks to fail for someone who isn't. Again, a simple API is a much more straightforward approach.