Stockal Securities: 13 Accounts Hit by Unauthorised Trades

Stockal said unauthorised trading on October 15 affected 13 customer accounts after an unauthorised third party accessed 26 accounts using valid login credentials, while reports estimate preliminary losses at more than Rs 100 crore. The final scale of losses, responsibility for the access, and any investor recovery remain unresolved.

What happened in the Stockal accounts on October 15?

Stockal said 13 customer accounts saw unauthorised trades on October 15 after 26 accounts appeared to have been accessed using valid login details. According to the company, large-cap US equity holdings in the 13 accounts were sold and the proceeds were used to purchase thinly traded microcap securities. It said no funds were withdrawn by the third party.

Media reports said affected investors found US holdings, including shares of Apple, Tesla, Amazon, Alphabet, NVIDIA and AMD, had been liquidated without consent. In one reported case, a portfolio worth about Rs 3.19 crore was sold and the proceeds were used to buy 3 lakh shares of Chinese company Zhibao Technology. Another investor reportedly said securities worth $3.1 million, or about Rs 29 crore, had been sold without authorisation.

How large are the reported losses for Stockal investors?

The reported preliminary loss estimate is more than Rs 100 crore, but the final extent has not been established. Moneycontrol reported on November 3 that nearly 30 Indian retail investors had alleged unauthorised transactions, with the estimate based on information from two investors. The reported figure should therefore not be treated as a final loss calculation for all affected accounts.

The damage appears to have arisen from the switch from established US stocks into relatively obscure and illiquid securities, rather than from a direct withdrawal of cash. Reports said Zhibao Technology, the Chinese stock bought in at least one cited case, fell nearly 60% in the following days. That price decline increased the gap between the value of the original holdings and the value of the securities left in the accounts.

What do Stockal and DriveWealth say about responsibility?

Stockal says its investigation has found no evidence of a breach or compromise of its platform, interface, infrastructure or internal systems. Its parent company, Borderless Investing, said it had engaged independent cybersecurity specialists and believed affected account holders may have been victims of social engineering. It also said this assistance did not amount to an admission of liability.

DriveWealth, Stockal's US brokerage and custody partner, has disputed responsibility. In an October 30 letter to an affected investor, DriveWealth said the unauthorised access occurred through the investor's interface with Stockal and that the activity did not initiate at DriveWealth. Stockal said DriveWealth notified it of the activity on October 15 during US market hours, October 16 in India, and access was then restricted shortly afterwards.

Was DriveWealth's September cyber incident linked to the trades?

No established evidence currently links DriveWealth's September cybersecurity incident to the October 15 transactions. DriveWealth disclosed unauthorised access to its network on September 4 and 5, during which personal information was exfiltrated. Borderless said the affected customers may have been targeted through social engineering involving information exposed in another company's earlier data breach, but described that possibility as unconfirmed.

This distinction matters because the public statements do not establish the route by which valid credentials were obtained or used. The competing accounts from Stockal and DriveWealth place the focus on the customer interface and account access, while neither statement presented conclusive evidence in the supplied information identifying the origin of the credentials or the party responsible for the trades.

Conclusion

The Stockal episode has brought attention to the risks facing Indian investors using platforms for overseas securities, particularly where account access can lead to rapid liquidation and purchases in illiquid stocks. The available information points to 26 accounts accessed and 13 accounts with trades, but it does not settle responsibility or confirm the eventual financial impact across all investors.

Investors will be watching the findings of the ongoing cybersecurity investigation, any resolution proposed for affected accounts, and responses from the Securities and Exchange Board of India and the US Securities and Exchange Commission. No timetable for a final investigation outcome or a confirmed restoration of account values has been disclosed.