Stockal scam: Nearly 30 Indian investors allege ₹100 crore losses after US stock holdings sold without authorisation

Nearly 30 retail investors have allegedly lost more than ₹100 crore in a suspected trading scam involving Bengaluru-headquartered fintech platform Stockal Securities, after their accounts were reportedly accessed without authorisation and their US stock portfolios liquidated, Moneycontrol reported.

The news outlet reported that the affected investors told that their holdings in major American companies were sold without their consent on October 15, with the proceeds allegedly used to purchase large quantities of thinly traded Chinese stocks. The transactions reportedly resulted in substantial losses to their investment portfolios.

Stockal Securities is a Bengaluru-based fintech platform registered with the Securities and Exchange Board of India (Sebi). It enables Indian retail investors to invest in US stocks, exchange-traded funds (ETFs) and other overseas securities.

The platform offers an India-facing application for account funding, trading and portfolio tracking, while working with US-based clearing brokers, including DriveWealth LLC, to execute trades and hold assets in custody.

Stockal investors’ US stock holdings allegedly sold without consent

According to the news outlet, one of the affected investors, a senior official at a leading Indian beverage company, said 10 of his major US stock holdings, including Apple, Tesla, Amazon, Alphabet, Nvidia and AMD, were liquidated without authorisation.

The total value of the shares reportedly sold was $335,768. The proceeds were subsequently used to place an unauthorised order for 300,000 shares of Chinese company Zhibao Technology Inc. at an average price of $1.05 per share.

The investor told Moneycontrol that he suffered losses of approximately $450,000, equivalent to around ₹4.26 crore, as a result of the transactions.

He also raised concerns over the absence of individual trade confirmations or warnings for the large-scale liquidation and subsequent purchase.

“Despite normal executed-trade emails being issued for my earlier authorized transactions, I received no corresponding individual confirmations or warnings for the mass sale of my portfolio and the ZBAO purchase on 15 October,” the investor was quoted as saying.

He said Stockal’s parent entity, Borderless, contacted him on October 18, acknowledging suspicious account activity on October 15 and informing him that DriveWealth had restricted activity on the account.

The investor has filed a complaint with Sebi, seeking regulatory intervention, and has also approached the US Securities and Exchange Commission (SEC).

Emails sent to Sebi and DriveWealth did not elicit a response at the time of publication, Moneycontrol reported.

Stockal says suspected phishing or social engineering under investigation

Stockal told Moneycontrol that the circumstances and mechanism behind the suspicious activity were under investigation.

In an email response to the publication, the company said its preliminary assessment indicated that the customer’s email account and associated credentials might have been compromised through social engineering or phishing.

“Based on our review to date, we have not identified any evidence of a breach of the Borderless/Stockal platform,” the company said in its response.

The company suggested that the alleged unauthorised trading activity could have resulted from compromised customer credentials rather than a breach of its own platform.

However, the precise identity of the person or persons who accessed the investors’ accounts and executed the trades on October 15 remains unclear.

Another investor alleges $3.1 million portfolio liquidation

Another affected investor, who spoke to Moneycontrol on condition of anonymity, alleged that securities worth $3.1 million, or approximately ₹29 crore, were sold without authorisation through the Stockal platform on October 15.

The investor said the entire portfolio was liquidated within two minutes, with the proceeds used to purchase 30.5 lakh shares of a thinly traded stock within the next 15 minutes.

“My entire portfolio was sold in two-minutes, and replaced with 30,50,000 shares of thinly traded stock, bought within 15 minutes, with no hold, alert or verification,” the investor told Moneycontrol.

The investor further said the account had not been restored and the losses had not been reimbursed.

An FIR has been registered in Bengaluru.

However, Moneycontrol clarified that HDFC Securities has not been named as an accused in the FIR.

DriveWealth blames Stockal over alleged account security failures

In a letter dated October 30 to one of the affected investors, DriveWealth reportedly denied responsibility for the alleged unauthorised account access and placed the responsibility on Stockal.

“The unauthorized third-party access to your account occurred in your interface with Stockal; any security lapses related to that platform are owned by Stockal. The unauthorized activity did not initiate at DriveWealth,” the US-based clearing broker said in the letter, according to Moneycontrol.

DriveWealth also said it had no responsibility or liability in connection with Stockal’s alleged account security failures.

The letter further stated that Stockal had informed DriveWealth that the investor’s account had experienced unauthorised third-party activity around October 15. Following the notification, Stockal instructed DriveWealth to freeze the account while its investigation continued.

However, DriveWealth alleged that Stockal’s instructions prevented it from taking further corrective action despite concerns about the investor’s continued exposure to the unauthorised positions.

According to the letter, DriveWealth had repeatedly raised concerns with Stockal that keeping the account frozen might not adequately limit the investor’s market exposure to the illicitly held securities.

It also alleged that some initial corrective measures intended to reduce the investor’s exposure were paused following explicit instructions from Stockal.

DriveWealth questions Stockal’s response to investor complaints

In its communication, DriveWealth also criticised Stockal’s handling of the incident, alleging that the fintech had not demonstrated sufficient urgency in addressing the issue or communicating with affected customers.

The US-based broker said it had followed up multiple times with Stockal since October 15 to determine whether the company had made meaningful efforts to contact the affected investor.

“Stockal has not confirmed any efforts it made to contact you,” DriveWealth said in the letter.

It further alleged that Stockal was waiting for another party to resolve problems arising from what DriveWealth described as the platform’s security failures and conflicting instructions.

The allegations by DriveWealth and Stockal’s preliminary assessment leave several questions unanswered, including how the investors’ accounts were accessed, who authorised the bulk liquidation of their US stock holdings and why the proceeds were allegedly channelled into concentrated positions in thinly traded Chinese securities.