you only get the private keys to coins if you withdraw.. Gox holds all (any) real coins. your cash and coin balances on the website are just numbers on their ledger - you don't actually have either anymore unless you withdraw. for Gox to sell a fake coin is as easy as taking real cash from your acct, transferring it to a Gox acct, and  increasing the number of coins that appear in your "balance" on the website. there don't have to actually be any coins unless you want to withdraw. that balance you see on the site is just a promise, an IOU