The allegations surrounding Stockal have exposed a difficult problem in digital investing: an Indian investor may interact with one platform, hold securities through another institution and depend on a foreign brokerage for execution and custody. When portfolios are allegedly liquidated without consent, responsibility becomes difficult to identify even before the question of compensation is addressed.
Nearly 30 Indian investors have alleged that US stock holdings in companies including Apple, Nvidia, Amazon, Tesla, Alphabet and AMD were sold on October 15, 2026. They say the proceeds were then used to purchase shares of Zhibao Technology Inc., a relatively thinly traded Chinese company listed on Nasdaq. The reported losses have been estimated at more than Rs 100 crore, although the source makes clear that this figure is based on information from two investors and has not been independently verified across all affected accounts.
The incident is being investigated through complaints to regulators in India and the United States, while an FIR has been registered in Bengaluru. Borderless, the parent company of Stockal, said its US brokerage and custody partner, DriveWealth, notified it of unauthorised trading activity in 13 customer accounts on October 16, India time. It said access to those accounts was restricted shortly afterwards.
The company also said an unauthorised third party appeared to have accessed 26 customer accounts using valid login credentials. In 13 accounts, it said, large-cap US equity holdings were sold and the proceeds used to purchase thinly traded microcap securities. Borderless said its investigation had found no evidence of a breach of its platform, interface, infrastructure or internal systems. It has engaged independent cybersecurity specialists, but its suggestion that customers may have been affected by a social-engineering attack linked to another company’s data breach remains unconfirmed.
That distinction is central. A platform breach, stolen credentials, a compromised email account, a failure in authentication or an unauthorised instruction processed through a legitimate login would involve different technical and regulatory questions. The available account does not establish which of these occurred. Stockal has said its review found no evidence of a breach of the Borderless or Stockal platform, while also stating that the circumstances and mechanism of the activity remain under investigation.
The reported transaction pattern is unusually important to understanding the case. One investor told Moneycontrol that 10 major US holdings were liquidated for approximately $335,768, after which the amount was allegedly used to purchase 300,000 Zhibao shares at an average price of $1.05. The investor estimated the loss at approximately $450,000, or Rs 4.26 crore, and said individual trade confirmations or warnings were not received in the usual manner.
Another investor alleged that securities worth $3.1 million, approximately Rs 29 crore, were liquidated within two minutes. The proceeds were allegedly used to purchase 30.5 lakh shares of a thinly traded stock within 15 minutes. The investor said the trades occurred without verification, notification or an opportunity to intervene, and that the account had not been restored or the losses reimbursed at the time described in the report.
These accounts point to two separate issues. The first is whether the trades were authorised. The second is whether the systems involved should have detected and interrupted a series of transactions that differed sharply from an investor’s existing portfolio. Selling diversified holdings in major technology companies and rapidly purchasing a large quantity of a relatively illiquid microcap security creates a transaction pattern that investigators will need to reconstruct through account logs, authentication records, order instructions, trade confirmations and custody records.
The fall in Zhibao’s share price intensified the reported losses but does not, by itself, prove wrongdoing. The investor cited in the report allegedly bought the shares at an average price of $1.05. Zhibao closed at $0.42 on October 23, a decline of nearly 60% from that reported purchase price. The final loss for each affected account would depend on the number of shares purchased, execution prices, subsequent transactions and the value of any remaining holdings.
The structure of the service makes accountability more complicated than a conventional domestic brokerage dispute. Stockal Securities is a Bengaluru-based fintech platform registered with SEBI as a stock broker. It provides an India-facing interface for account funding, trading and portfolio monitoring, while overseas investments involve US-based brokerage and clearing partners, including DriveWealth LLC. The customer-facing platform, order-execution entity and securities custodian may therefore be different institutions.
That separation can provide access to international markets, but it also creates several points at which records, controls and responsibilities must align. An investor may reasonably see a single portfolio on an app, while the legal and operational chain behind it includes an Indian intermediary, a foreign broker, a custody arrangement and market infrastructure in the United States. If an unauthorised transaction occurs, the investigation must determine where the instruction originated, who authenticated it, which entity transmitted it and which institution had the ability to stop it.
DriveWealth has disputed responsibility. In a letter dated October 30 to an affected investor, the US brokerage reportedly said the unauthorised access occurred through the investor’s interface with Stockal. It maintained that the activity did not originate at DriveWealth and that security lapses associated with Stockal’s platform were Stockal’s responsibility. DriveWealth also said it froze the affected account after receiving instructions from Stockal. Its criticism of Stockal’s handling of the matter remains an allegation contained in its communication and has not been independently established.
Borderless, for its part, said no funds were withdrawn from the affected accounts. This is an important but limited clarification. The reported harm arose from securities allegedly being sold and replaced with other securities, rather than from a direct cash transfer out of the account. For investors, however, the absence of a withdrawal does not eliminate the financial consequence if valuable holdings were converted into a falling and less liquid stock without authorisation.
The mention of HDFC Securities adds another layer to the institutional history. HDFC Securities partnered with Stockal in 2019 to launch a global investing offering through globalinvesting.in. Some affected investors had been introduced to Stockal through that arrangement. HDFC Securities’ operational partnership with Stockal ended in July 2024, while the alleged transactions occurred in October 2026. HDFC Securities said it was not named among the accused in the FIR, reaffirmed its focus on customer trust and regulatory compliance, and said it would cooperate with regulators and authorities as required.
The FIR reportedly names DriveWealth LLC, Stockal Securities, Borderless Softech Private Limited, Borderless Investing Inc. and HDFC Securities. Being named in an FIR does not establish guilt, and the source does not report a final finding by the police, SEBI, the US Securities and Exchange Commission or any court. The investigation must still establish the identity of the person or group that accessed the accounts, the route used to gain access and the extent to which each institution’s controls operated as intended.
The case also illustrates the limits of relying on a platform’s visible interface as a measure of control. A customer may receive a simple digital experience, but overseas investing depends on multiple contractual and technical relationships. The platform must authenticate the user, the broker must accept and execute instructions, the custodian must maintain the securities and the investor must receive accurate and timely records. A failure at any point can leave the customer facing an unfamiliar chain of responsibility.
The source does not establish whether additional authentication was available, whether transaction limits or anomaly alerts were triggered, or whether the affected accounts had similar login patterns. It also does not establish whether trade confirmations were generated but not received, whether warnings were bypassed or whether the transactions were treated by the system as valid because the credentials appeared genuine. Those questions are not technical details at the margins; they will determine how the event is understood and who may bear responsibility.
For Indian investors using international platforms, the dispute highlights a governance challenge created by cross-border finance. The service may be marketed and accessed in India, while execution, custody, market surveillance and parts of the investigation sit in another jurisdiction. Complaints may therefore need to move between Indian regulators, US authorities, the police and private institutions. The investor’s practical problem is immediate, but the formal process is distributed across several systems.
The episode should not be treated as proof that overseas investing platforms are inherently unsafe. Nor does the information currently available establish that Stockal, Borderless, DriveWealth or any other named entity caused the alleged losses. What it does establish is that investors reported a dramatic mismatch between their intended portfolios and the securities appearing in their accounts, while the institutions involved offered differing preliminary accounts of how access occurred.
The unresolved questions are therefore specific: how many accounts were affected; how were the transactions authenticated; why were large-cap holdings exchanged for thinly traded securities; what alerts or intervention procedures were available; what records can reconstruct the sequence; and how will regulators determine compensation, if wrongdoing or control failures are established? Until those questions are answered through the FIR, regulatory reviews, forensic investigation and account-level reconciliation, the reported Rs 100 crore figure must remain a preliminary estimate rather than a confirmed loss total.
