Treasuries leave “doors open” to fraud without supplier checks