Stockal Row: Indian Investors Say US Shares Were Sold Without Consent

Conflicting accounts

Stockal's parent, Borderless Investing, says brokerage partner DriveWealth alerted it on October 16, India time, to suspicious trading in 13 accounts. Its assessment is that an unauthorised third party accessed 26 accounts using valid login credentials, and that large-cap US equities were sold for thinly traded microcaps in 13 of them. Borderless says it found no evidence of a breach of its platform or systems, and that no funds were withdrawn. It floated social engineering using data exposed in another company's breach several weeks earlier, while stressing that this link is unverified.

DriveWealth reportedly told an investor in an October 30 letter that the access occurred through the Stockal interface and that Stockal bore responsibility for the security lapses. The company told reporters: "The Stockal incident is unrelated to DriveWealth's systems. It occurred on Stockal's app, not our platform."

Why it matters

Zhibao shares closed at $0.42 on October 23, roughly 60% below the average purchase price of about $1.05 cited by investors. Whether or not money left the accounts, investors' core complaint is that their holdings were changed without consent.

Cybersecurity expert Yash Kadakia of Security Brigade said platforms cannot shift blame entirely onto customers when stolen passwords can trigger financial transactions. He argued for two-factor authentication, SIM binding, device and location checks, separate transaction-level authentication and behavioural monitoring.

Borderless says it has hired independent cybersecurity specialists, added authentication and account-protection measures, and is working with DriveWealth and authorities to reconstruct events and seek a fair resolution, without admitting liability. The exact access method is still under investigation.