Yes. HSA custodians do not verify that your withdrawals were qualified — you self-certify on Form 8889, and the burden of proof is entirely yours.
Yes. And the reason surprises people: nobody checks your withdrawals at the time you make them.
When you take money out of an HSA, your custodian reports the total on Form 1099-SA. They do not evaluate whether it was a qualified expense. You do that yourself on Form 8889, by declaring how much of the distribution went to qualified medical expenses.
That's a self-certification. It gets accepted at face value — until it doesn't. If the IRS questions a return, the burden of proving each distribution was qualified sits entirely with you. No receipt means the distribution is treated as non-qualified: ordinary income tax, plus a 20% penalty if you're under 65.
The lack of upfront verification is exactly why documentation discipline matters. Nothing stops you from making an unsupported withdrawal. Something eventually stops you from defending it.