Stockal Scam: Another Investor Claims $1 Million Loss After Unauthorised Liquidation of US Stocks

The Stockal controversy has widened after another investor alleged that his brother lost approximately $1 million when his US stock holdings were allegedly liquidated without his consent. The latest account adds to a growing list of complaints involving Bengaluru-based fintech platform Stockal Securities, with investors claiming that valuable US shares were sold and replaced with highly volatile, thinly traded securities.

The allegations relate to trading activity reported on October 15, when multiple customer accounts were allegedly accessed by an unauthorised third party. While investors are seeking answers and compensation, Stockal’s parent company, Borderless Investing, has denied that its platform was breached. The company says it is investigating a possible social engineering attack involving compromised login credentials, but the cause and responsibility for the incident have not yet been established.

Another Investor Reports a $1 Million Loss

According to Moneycontrol, an individual approached the publication claiming that his brother had suffered a loss of around $1 million in transactions similar to those reported by other affected Stockal customers.

The family member said the investor had been deeply affected by the incident and was experiencing depression. The family is considering its next steps to seek relief.

The investor’s brother spoke on condition of anonymity. He also clarified that his brother had not been introduced to Stockal through HDFC Securities, although HDFC’s investment in the platform had contributed to its credibility among investors.

The latest allegation highlights how the controversy is expanding beyond the initial group of investors who reported unauthorised transactions. It also raises questions about the extent of the financial exposure and the number of accounts potentially affected.

Nearly 30 Investors Allegedly Affected

On November 3, Moneycontrol reported that nearly 30 retail investors had allegedly suffered losses exceeding ₹100 crore in unauthorised trades linked to Stockal.

Investors claimed that their accounts were accessed without permission on October 15. Their existing holdings in major US companies were allegedly sold, and the proceeds were used to purchase shares of thinly traded microcap companies.

One investor, a senior official at a major Indian beverage company, said 10 of his US stock holdings were liquidated without authorisation. These included shares of Apple, Tesla, Amazon, Alphabet, Nvidia and AMD.

The total value of the holdings sold was approximately $335,768. According to the investor, the entire amount was redirected into a single purchase order for 300,000 shares of Chinese company Zhibao Technology Inc., which trades in the United States under the ticker ZBAO.

The shares were reportedly purchased at an average price of $1.05 each. Zhibao Technology subsequently declined nearly 60%, closing at $0.42 on October 23.

The investor estimated his loss at approximately $450,000, or around ₹4.26 crore. He also complained that he did not receive the usual individual trade confirmations or warnings for the disputed transactions.

Another investor told Moneycontrol that securities worth $3.1 million, equivalent to approximately ₹29 crore, were sold from their account. The investor alleged that the portfolio was liquidated within minutes and replaced with 30.5 lakh shares of a thinly traded stock.

The reported losses exceeding ₹100 crore are preliminary estimates based on information provided by investors. The final financial impact has not been independently established.

What Stockal’s Parent Company Says

Borderless Investing, the parent company of Stockal Securities, issued a detailed response on November 4, denying responsibility for the unauthorised trading activity.

The company said its investigation had found no evidence of a breach or compromise involving its platform, interface, infrastructure or internal systems. It has also engaged independent cybersecurity specialists to examine the incident.

According to Borderless, an unauthorised third party appears to have accessed 26 customer accounts using valid login credentials. In 13 of those accounts, existing large-cap US equity holdings were sold and the proceeds were used to purchase thinly traded microcap securities.

The company said its US brokerage and custody partner, DriveWealth, notified it of unauthorised trading activity in 13 customer accounts on October 16 in India, corresponding to October 15 during US market hours. Access to the affected accounts was restricted shortly afterwards.

Borderless suggested that the affected customers may have been victims of a social engineering attack involving information exposed in a data breach at another company several weeks earlier.

However, it emphasised that this connection remains unconfirmed and is still being investigated.

The company also said that, based on its investigation so far, no funds had been withdrawn from the affected accounts. It has introduced additional authentication and account-protection measures as a precaution.

Borderless denied liability, negligence or responsibility for the unauthorised activity, saying it would continue working with DriveWealth to establish the facts and explore possible avenues for a fair resolution.

Why DriveWealth Is Also Part of the Dispute

The incident involves more than one financial intermediary because Stockal provides the India-facing investment platform while relying on US-based brokerage and custody infrastructure.

Stockal Securities is a Bengaluru-based fintech company registered with the Securities and Exchange Board of India (SEBI). It enables Indian retail investors to access US stocks, exchange-traded funds and other overseas securities.

Its US partner, DriveWealth LLC, provides brokerage and custody services connected with the execution and holding of investments.

The responsibilities of the two companies have become a central issue in the dispute.

In a letter dated October 30 to one affected investor, DriveWealth reportedly said that the unauthorised third-party access occurred through the customer’s interface with Stockal. It denied that the activity originated at DriveWealth and rejected responsibility for alleged security failures on Stockal’s platform.

DriveWealth also said it had frozen the affected account after receiving instructions from Stockal. According to the letter, it had raised concerns that leaving the unauthorised positions unchanged could expose investors to further market risk.

The brokerage further alleged that some initial corrective actions were paused following instructions from Stockal.

These statements represent DriveWealth’s position and have not been independently established as findings of liability. They also illustrate the disagreement between the companies over who was responsible for account security and how the response should have been handled.

HDFC Securities Connection Adds Another Dimension

Some affected investors had accessed Stockal through a partnership involving HDFC Securities.

In 2019, HDFC Securities partnered with Stockal to launch the globalinvesting.in service, providing customers with access to international investment opportunities.

However, the operational global investing partnership between the two companies ended in July 2024.

Investors have referred to HDFC Securities’ earlier association and investment in Stockal while explaining why they considered the platform credible. The latest investor who spoke to Moneycontrol said his brother was not introduced through HDFC Securities.

The historical association has brought HDFC Securities into the wider discussion, although the available reports do not establish that it was responsible for the disputed transactions.

Regulatory Complaints and Investor Concerns

The controversy has already prompted investors to approach regulatory and law-enforcement authorities.

One affected investor has reportedly filed a complaint with SEBI and approached the US Securities and Exchange Commission (SEC). Another investor has registered a first information report in Bengaluru, naming Stockal Securities, Borderless entities, DriveWealth and HDFC Securities.

The complaints underline the complications involved in overseas investing through cross-border financial arrangements. Investors may have to deal with an Indian intermediary, a foreign brokerage, a custodian and multiple corporate entities when seeking explanations or remedies.

Moneycontrol has also reported that investors can consider filing complaints through SEBI’s SCORES platform and approaching relevant US authorities, depending on the entities and activities involved.

However, filing a complaint does not automatically guarantee reimbursement. The outcome will depend on the investigation, the contractual responsibilities of the parties and the applicable regulatory and legal processes.

The Bigger Picture

The Stockal incident raises important questions about the security of digital investment platforms and the safeguards protecting overseas stock portfolios.

Investors generally expect brokerage accounts to have strong authentication, transaction monitoring and alerts for unusual activity. The alleged liquidation of established blue-chip holdings followed by concentrated purchases of thinly traded securities highlights the potential consequences when account access and transaction controls fail.

The case also exposes the complexity of cross-border investing. When an Indian platform works with a foreign brokerage and custodian, responsibility for account security, trade execution, customer communication and corrective action can become contested.

For the wider fintech industry, the investigation could become an important test of how platforms manage cybersecurity risks and respond when customers report unauthorised transactions.

Looking Ahead

The immediate priority is to establish how the affected accounts were accessed, who placed the disputed orders and whether the transactions could have been prevented or reversed. Independent cybersecurity findings, transaction records and communications between Stockal and DriveWealth will be important in determining what happened. Investors are also waiting for clarity on whether their holdings can be restored or whether compensation will be offered.

Borderless Investing has said it is cooperating with relevant authorities and working with DriveWealth, but it has not accepted liability. Until the investigation establishes the cause and responsibility, the reported losses remain allegations rather than a final determination of wrongdoing. The case could have wider implications for investor confidence in Indian fintech platforms offering access to international markets.