An Indian investor has alleged that his US stock portfolio worth approximately Rs 3.19 crore was sold without his consent through Bengaluru-based fintech platform Stockal on October 15. The proceeds were subsequently used to purchase 3 lakh shares of Chinese digital insurance company Zhibao Technology, according to the investor's complaint.
The portfolio included shares of major US companies such as Apple, Tesla, Amazon, Alphabet and Nvidia. The investor, a senior official at a leading Indian beverage company, claimed he neither initiated nor approved the transactions and received no alerts about the sales.
The complaint, dated November 2, raises questions about account access, transaction notifications and the movement of securities following the disputed trades.
Ten US Stock Holdings Sold in a Single Day
According to the complaint, 10 US stock holdings were sold for gross proceeds of $335,768.08, approximately Rs 3.19 crore.
The holdings included 150 Apple shares, 234.8 Tesla shares, 93 Palantir shares, 80 Amazon shares, 40 Alphabet shares, 80 AMD shares, 60 Gilead Sciences shares, 400 Nvidia shares, 52 Delta Air Lines shares and 60 Lemonade shares.
The proceeds were used to purchase 3 lakh Zhibao Technology shares for $315,681.25. The transaction also involved a reported $3,000 commission.
The gross sale value should not be treated as the investor's confirmed final loss, which depends on the value of securities and cash ultimately restored to the account.
Account Records Raise Questions Over Missing Shares
The investor's account records reportedly show several adjustments after the October 15 transactions.
On October 16, 73 adjustment entries transferred the 3 lakh Zhibao shares to an internal account. Later entries recorded the original securities as credited back, followed by another set of entries showing those holdings as sold again.
On October 19, a further adjustment credited 2,61,733 Zhibao shares to the investor's account, alongside a cash debit of $275,422. This left 38,267 shares unaccounted for in the complaint's reconciliation.
A commission credit of $3,834.51 was recorded the following day, while the last cash balance shown was $60,512.58.
The investor has sought restoration of his original portfolio, including share quantities, acquisition dates, tax cost bases, dividends and other entitlements.
How Was the Investor's Account Accessed?
The method used to access the account remains one of the central questions in the investigation.
In an October 27 response, Stockal said valid login credentials appeared to have been used and that the registered email address or other account details had subsequently changed.
The company said it had not identified evidence of a breach of its platform at that stage. It was also examining why transaction alerts and confirmations may not have reached the investor.
Stockal reportedly suggested that the investor's email account or credentials could have been compromised through phishing or social engineering.
DriveWealth and Stockal Dispute Responsibility
The case has triggered a disagreement between Stockal and its US brokerage partner, DriveWealth.
In a letter dated October 30, DriveWealth told an affected investor that the unauthorised access had occurred through the investor's interface with Stockal. It maintained that any security lapses involving that platform were Stockal's responsibility and said the activity had not originated within DriveWealth.
DriveWealth also claimed that Stockal had instructed it to freeze the affected account and that certain corrective actions were paused on Stockal's instructions.
Separately, DriveWealth had disclosed a cybersecurity incident on September 4 and 5, during which personal information was reportedly exfiltrated. Stockal told the investor that his information was among the affected data. However, no established evidence has linked that incident to the October transactions.
Stockal Parent Company Denies Liability
On November 4, Borderless Investing, the parent company of Stockal Securities, denied liability or wrongdoing.
In a response to Moneycontrol, the company said an unauthorised third party appeared to have accessed 26 customer accounts using valid credentials. In 13 accounts, large-cap US stocks were allegedly sold and the proceeds used to purchase thinly traded microcap securities.
Borderless said its investigation had found no evidence of a breach involving its platform, infrastructure or internal systems. It also stated that no funds had been withdrawn, based on its investigation to date.
The company said it had introduced additional authentication and account-protection measures while continuing to investigate a possible social-engineering attack.
Wider Stockal Controversy Raises Investor Concerns
The case is part of a wider controversy involving Stockal-linked accounts. Moneycontrol reported that nearly 30 investors had alleged unauthorised transactions, with preliminary losses estimated at more than Rs 100 crore. The final extent of the losses remains unclear.
Another reported case involved an investor who alleged that securities worth $3.1 million, approximately Rs 29 crore, were sold within two minutes before 30.5 lakh shares of a thinly traded stock were purchased.
A Bengaluru FIR reportedly names DriveWealth LLC, Stockal Securities, Borderless Softech Private Limited, Borderless Investing Inc. and HDFC Securities.
Key questions remain about who accessed the accounts, whether the September cybersecurity incident was connected to the transactions, why investors did not receive alerts and whether their original holdings have been restored.
Until the investigation establishes the sequence of events and responsibility, the total losses and the parties accountable remain uncertain.
Conversation
Be kind and stay on topic. Comments are moderated; abuse, spam and personal attacks are removed. Report a problem