The payment app, used by millions and celebrated by rappers, “had no effective procedure" to establish the true identity of customers, two whistleblowers told officials