US stocks were sold without consent: Inside investor's Rs 3.19-crore Stockal ordeal

An Indian investor who had been buying US stocks through Stockal since 2020 was left shocked when he discovered that shares worth $335,768 (approximately Rs 3.19 crore) in his portfolio had been sold without his authorisation. The proceeds were used to buy 3 lakh shares of Chinese company Zhibao Technology, a transaction he says he neither initiated nor approved.

He is among nearly 30 retail investors who have reported similar incidents involving Stockal. As reported by Moneycontrol, their accounts were allegedly accessed without authorisation, after which their US stock holdings, including shares of large, well-known companies, were sold. The proceeds were then used to buy shares of thinly traded stocks, exposing investors to a different and potentially riskier set of securities without their consent.

Preliminary losses exceeded Rs 100 crore, based on losses disclosed by two investors, reported Moneycontrol although the total financial impact remains unclear.

The investor, a senior official at a leading beverage company in India, told IndiaToday.in that he was introduced to Stockal through HDFC Securities and had been using the platform for his US investments for around six years. He said the arrangement had worked smoothly until October 2026, when he was informed of suspicious activity in his account.

“I have been investing in US securities through a platform called Stockal since 2020. Stockal was introduced to us by HDFC Securities,” he said.

According to the investor, he first received an email on October 18 informing him that suspicious trading activity had taken place in his account and could have financial implications. When he contacted the company, he was told that some securities had been sold and that the matter was being investigated.

He said he was assured that Stockal was working with its US brokerage partner, DriveWealth, to reinstate his account and that he should have faith in the process. However, he said the company subsequently went quiet, leaving him to repeatedly seek updates.

The investor's account is one of the cases in a wider controversy involving Stockal-linked accounts. Moneycontrol reported on November 3 that nearly 30 investors had alleged unauthorised transactions, with preliminary losses estimated at more than Rs 100 crore. The final extent of the losses remains unclear.FROM BLUE-CHIP STOCKS TO A LITTLE-KNOWN COMPANY

According to the investor's complaint and transaction records reviewed by IndiaToday.in, 10 US stock holdings were sold on October 15 for gross proceeds of $335,768.08. These included 150 Apple shares, 234.8 Tesla shares, 93 Palantir shares, 80 Amazon shares, 40 Alphabet shares, 80 AMD shares, 60 Gilead Sciences shares, 400 Nvidia shares, 52 Delta Air Lines shares and 60 Lemonade shares.

The proceeds were then used to purchase 3 lakh shares of Zhibao Technology Inc, listed on Nasdaq, for $315,681.25. The complaint also records a $3,000 commission on the purchase.

The investor said he was not informed when his original holdings were sold or when the Zhibao shares were purchased. He said he learnt the extent of the transactions only after repeatedly asking Stockal for an account statement, which he received around October 23 or 24.

“I said, how can that happen? They said something had happened and that they were still trying to figure it out,” he told IndiaToday.in.

The $335,768.08 figure represents the gross value of the original shares sold. It should not be read as the investor's confirmed final loss, which would depend on the value of the securities and cash ultimately restored to the account and any subsequent recovery.INVESTOR QUESTIONS TRANSACTIONS AFTER ACCOUNT WAS FLAGGED

The investor's concerns go beyond the initial sale of his shares. He questioned why further transactions and adjustments were carried out in his account after the incident had been detected.

Account records reviewed by IndiaToday.in show that on October 16, 73 entries marked as adjustments transferred the 3 lakh Zhibao shares from the investor's account to an internal account. Later that day, entries recorded the original securities as credited back. But another set of entries subsequently recorded those holdings as sold again.

On October 19, a further adjustment credited 2,61,733 Zhibao shares to the investor's account, alongside a cash debit of $275,422. That left 38,267 shares unaccounted for in the complaint's reconciliation.

The next day, the ledger recorded a commission credit of $3,834.51. The last cash balance shown was $60,512.58.

The investor said the value of the Zhibao shares had fallen sharply by the time the subsequent adjustments were made. According to him, the original purchase involved around $335,000, while the value had fallen to approximately $66,000 by the time the brokerage intervened. He questioned why the account continued to see activity after he had been told that suspicious transactions had been detected.

“How do I know the first transaction was not done by them? If you're doing one transaction, then why are you doing transactions in my account without telling me?” he said.

The records do not by themselves establish whether the adjustments represented fresh exchange trades or internal back-office movements. Nor do they establish that the investor's original portfolio was fully restored.

He has sought restoration of his holdings as they stood on October 14, including the original quantities, acquisition dates and tax cost bases, along with cash, dividends and other entitlements. He has said the Zhibao shares cannot be treated as a substitute for the portfolio that was sold.advertisementEMAIL ADDRESS CHANGE AND MISSING ALERTSAnother major concern raised by the investor is how someone was able to access his account and apparently change his registered email address.

In its October 27 response to the investor, Stockal said valid login credentials appeared to have been used and that the registered email address and/or other account details had subsequently changed. It said it had not found evidence of a breach of its platform at that stage and was examining why the investor may not have received transaction alerts or confirmations.

The investor disputed the suggestion that the use of valid credentials meant the transactions were authorised. He said he had not requested a change to his registered email address and had received no effective alert or approval request before the disputed activity.

He compared this with an earlier request to change his residential address from Bengaluru to Gurugram. He said Stockal had asked him to submit Aadhaar documentation and told him that the process would take 48 to 72 working hours.

“I said, last I remember, I wanted to change my postal address from Bangalore to Gurgaon. I sent you a mail. You asked me for Aadhaar card. You said after submitting Aadhaar card, you have to wait for 48 to 72 hours,” he said.

He questioned why a change to a more sensitive account detail, such as his registered email address, appeared to have taken place without a similar verification process or his consent.

Stockal's October 27 response does not conclusively identify which specific account detail was changed. The investor has sought the complete audit trail, including login records, device and session details, authentication records and logs showing whether alerts were generated and delivered.SEPTEMBER DATA BREACH: WHY WAS HE NOT INFORMED?

The investor also raised questions about a cybersecurity incident at DriveWealth in September.

DriveWealth had disclosed unauthorised access to its network on September 4 and 5, during which personal information was exfiltrated. The investor said he was subsequently told that his information was among the data affected and that DriveWealth had informed Stockal about the incident.

He told IndiaToday.in that he was not informed about the potential exposure before the October 15 transactions. He said he would have taken steps such as changing his password or seeking additional security measures had he been alerted.

The complaint also records that Stockal had informed him that his personal information was among the information compromised in the September incident. It seeks details of when Stockal was notified, when it became aware that his information was affected and what steps it took to protect the account.

However, there is no established evidence linking the September DriveWealth incident to the October 15 transactions. Whether information exposed in that incident was used to access the accounts remains under investigation.STOCKAL AND DRIVEWEALTH GIVE DIFFERENT EXPLANATIONS

The investor said the explanations he received from Stockal and DriveWealth have raised further questions about who was responsible for the transactions and the subsequent handling of his account.

According to his account of the communication, DriveWealth told him that Stockal had instructed it to sell the shares. He said the US brokerage also claimed that it had asked Stockal to freeze the account and reverse the transactions after being alerted to the suspicious activity.

In a letter dated October 30 to an affected investor, DriveWealth said the unauthorised access had occurred through the investor's interface with Stockal and that any security lapses relating to that platform were Stockal's responsibility. It said the activity had not originated at DriveWealth.

DriveWealth also claimed that Stockal had instructed it to freeze the affected account and that certain corrective actions were paused on Stockal's instructions. These are DriveWealth's claims in its communication; they do not amount to an independent finding on responsibility.

The investor said Stockal, meanwhile, had pointed to the September data breach and the possibility that his information had been exposed. He questioned why the two firms appeared to be shifting responsibility instead of providing a clear account of what happened.

“You came to me. So your word was binding, not theirs,” he said, referring to Stockal's role as the platform through which he had invested.

On November 4, Borderless Investing, the parent company of Stockal Securities, denied liability or wrongdoing. In a response to Moneycontrol, it said an unauthorised third party appeared to have accessed 26 customer accounts using valid credentials. In 13 of those accounts, large-cap US stocks were sold and the proceeds used to buy thinly traded microcap securities.

Borderless said it had found no evidence of a breach of its platform, interface, infrastructure or internal systems. It also said that, based on its investigation to date, no funds had been withdrawn. The company said a possible social-engineering attack involving information exposed in another company's data breach remained under investigation, but that the connection had not been confirmed. It said it had introduced additional authentication and account-protection measures.INVESTMENTS WERE MEANT FOR HIS CHILDREN'S EDUCATION

For the investor, the dispute is not just about a portfolio or the movement of shares. He told IndiaToday.in that he had been investing with the aim of supporting the education of his two sons, who are studying in the US.

He said the incident has left him having to pursue multiple companies and authorities while continuing with his regular job. He has written to Sebi and said he has also approached US authorities, including the FBI, the Securities and Exchange Commission and FINRA. The complaint dated November 2 confirms his representation to Sebi.

The investor said he wants a clear explanation of how the account was accessed, why he was not alerted and what steps will be taken to restore his original holdings.

He also said he had recorded conversations with company representatives, which he believes could help establish what he was told after the incident.WHAT ELSE DO WE KNOW?

Moneycontrol reported other cases of unauthorised transactions, including one in which an investor alleged that $3.1 million (about Rs 29 crore) worth of securities were sold within two minutes, followed by the purchase of 30.5 lakh shares of a thinly traded stock.

It also reported a Bengaluru FIR naming DriveWealth LLC, Stockal Securities, Borderless Softech Private Limited, Borderless Investing Inc. and HDFC Securities. The preliminary estimate of losses exceeding Rs 100 crore was based on investor accounts and is not a verified total.

Several questions remain unanswered: who accessed the accounts, whether the September DriveWealth data breach was connected to the October transactions, why investors did not receive trade alerts, and whether all affected investors have got their original holdings back. The dispute between Stockal and DriveWealth over the account activity also remains unresolved.

For the investor, the immediate demand is the restoration of the original portfolio and a clear explanation of how the transactions took place. Until the firms provide a complete account of the trades and subsequent adjustments, the extent of the financial impact and responsibility for the incident remain uncertain.- Ends