They don't. They request some documentation, verify some facts that they can correlate other sources, but mostly they rely on the fact that intentionally lying in the declarations is a crime - they can trust most reports, audit some, and penalize those violators they caught as a deterrent to make it not worth the risk to lie.

The companies that you have these accounts with, and your employer have reporting requirements.

They probably don't, but when something looks suspicious enough, in comes the audit.