The checks in place seem pretty minimal. What's stopping spoofed transfers between institutions or end users?