The checks in place seem pretty minimal. What's stopping spoofed transfers between institutions or end users?

The participants (the banks) are trusted to validate transactions before sending them, and are responsible for fixing bad transactions. And if they keep screwing up they can lose access.