That would be trivially easy to prove with a simple audit, which they have not done, so the default assumption must be that there is something fishy with them.