XRF machines are about $15K and really only detect the surface of the metal under test. They are also a tad tricky to use. If a bogus bar was tungsten and merely gold-plated, it would probably fail such a test. But if it started out as a genuine PAMP gold bar and was then drilled, like the bars pictured below (which are silver, not gold, and with lead inserts, not tungsten, but I show them for the fakery technique) with tungsten rods inserted, I have some doubt an XRF assay would reveal the fake core(s).
http://www.youtube.com/watch?v=kyQSSmVcb6c
Correct, but I doubt that any facility that is worried about this problem would be unable to afford the $15K.
...and really only detect the surface of the metal under test."
Incorrect. X-rays penetrate quite nicely, in both directions. This isn't photoelectron spectroscopy, which "is" very depth limited. Yes, there "are" shielding effects based on atomic number of substrate, so penetration depth "is" better for lighter elements, but I would certainly expect mm's of penetration if not cm's. I suspect one can get charts from the mfg. with the requisite info.
"They are also a tad tricky to use."
Hardly. Correct interpretation of data requires some knowledge, but "use" is about a simple as it gets....hold it against the "target" and "pull/hold the trigger".
And yes, I've looked at the ubiquitous stories that all contain the statement "it passed a hand-held XRF test". One even claimed that XRF "..only penetrates the first 0.001 inch", which is complete BS. I suspect this was a completely untrained operator that was using it as a "magic box".