Probably Shift verifies that the correct key on the blockchain (ie correct coinbase user) holds the correct amount of bitcoin, then fronts the USD and does the bitcoin transfer on the back end.

Edit: downvotes don't tell me why I'm wrong, would appreciate counterexample, I don't see any docs on the Shift site, and there's no way in hell they're using zeroconf transactions at this scale, which means instant payments must come out of a USD account somewhere