An Indian investor alleged that his US stock portfolio was sold without authorisation and replaced with Zhibao shares. The disputed trades and later account adjustments prompted competing claims from Stockal and DriveWealth.According to the investor's complaint, 10 US stock holdings were sold on October 15 for gross proceeds of $335,768.08, or approximately Rs 3.19 crore.

An Indian investor's US stock portfolio worth approximately Rs 3.19 crore was liquidated without his authorisation on October 15, with the proceeds used to buy 3 lakh shares of Chinese company Zhibao Technology. Ten holdings, including Apple, Tesla, Amazon, Alphabet and Nvidia, were sold in the process.The trades took place through Stockal, a Bengaluru-based fintech platform that enabled Indian investors to access US-listed stocks.

It worked with US-based brokerage and custody partner DriveWealth.The investor said he had neither initiated nor approved the transactions and received no alerts informing him that his holdings had been sold. Transaction records and a detailed complaint dated November 2, reviewed by IndiaToday.in, show how the sale and subsequent purchase unfolded — and raise questions about what happened to the money and securities afterwards.The case is part of a wider controversy involving Stockal-linked accounts.

Moneycontrol reported on November 3 that nearly 30 investors had alleged unauthorised transactions, with preliminary losses estimated at more than Rs 100 crore. The final extent of the losses, however, remains unclear.

STOCKS SOLD WITHOUT CONSENTAccording to the investor's complaint, 10 US stock holdings were sold on October 15 for gross proceeds of $335,768.08, or approximately Rs 3.19 crore. The stocks included 150 Apple shares, 234.8 Tesla shares, 93 Palantir shares, 80 Amazon shares, 40 Alphabet shares, 80 AMD shares, 60 Gilead Sciences shares, 400 Nvidia shares, 52 Delta Air Lines shares and 60 Lemonade shares.The proceeds were used to purchase 3 lakh shares of Zhibao Technology Inc, listed on Nasdaq, for $315,681.25.

The complaint also records a $3,000 commission on the purchase. The Rs 3.19-crore figure represents the gross value of the shares sold.

It should not be read as the investor's confirmed final loss. That would depend on the value of the securities and cash ultimately restored to the account, and any subsequent recovery.TRAIL OF MISSING SHARESThe account records reviewed by IndiaToday.in show a series of adjustments after the October 15 transactions.On October 16, 73 entries marked as adjustments transferred the 3 lakh Zhibao shares from the investor's account to an internal account.

Later that day, entries recorded the original securities as credited back. But another set of entries subsequently recorded those holdings as sold again.On October 19, a further adjustment credited 2,61,733 Zhibao shares to the investor's account, alongside a cash debit of $275,422.

That left 38,267 shares unaccounted for in the complaint's reconciliation.The next day, the ledger recorded a commission credit of $3,834.51. The last cash balance shown was $60,512.58.These entries raise questions about the movement of securities and money within the account.

The records, however, do not by themselves establish whether the adjustments represented fresh exchange trades or internal back-office movements. Nor do they establish that the investor's original portfolio was fully restored.The investor has sought restoration of his holdings as they stood on October 14, including the original quantities, acquisition dates and tax cost bases, along with the cash, dividends and other entitlements.

He has said that the Zhibao shares cannot be treated as a substitute for the portfolio that was sold.HOW WAS THE ACCOUNT ACCESSED?This remains one of the central unanswered questions.In its October 27 response to the investor, Stockal said valid login credentials appeared to have been used and that the registered email address and/or other account details had subsequently changed. It said it had not found evidence of a breach of its platform at that stage and was examining why the investor may not have received transaction alerts or confirmations.Moneycontrol reported that Stockal had also suggested the customer's email account and credentials may have been compromised through phishing or social engineering.

The company said its review had not identified evidence of a breach of the Borderless or Stockal platform.There had also been a cybersecurity incident at DriveWealth in September. The US brokerage disclosed unauthorised access to its network on September 4 and 5, during which personal information was exfiltrated.

Stockal reportedly told the investor that his information was among that affected.But there is no established evidence linking the September incident to the October 15 transactions. Whether information exposed in that incident was used to access the accounts remains under investigation.DISPUTE OVER RESPONSIBILITYThe incident has also triggered a dispute between Stockal and DriveWealth.In a letter dated October 30 to an affected investor, DriveWealth said the unauthorised access had occurred through the investor's interface with Stockal and that any security lapses relating to that platform were Stockal's responsibility.

It said the activity had not originated at DriveWealth.DriveWealth also claimed that Stockal had instructed it to freeze the affected account and that certain corrective actions were paused on Stockal's instructions. These are DriveWealth's claims in its communication to the investor; they do not amount to an independent finding on responsibility.On November 4, Borderless Investing, the parent company of Stockal Securities, denied liability or wrongdoing.

In a response to Moneycontrol, it said an unauthorised third party appeared to have accessed 26 customer accounts using valid credentials. In 13 of those accounts, large-cap US stocks were sold and the proceeds used to buy thinly traded microcap securities.Borderless said it had found no evidence of a breach of its platform, interface, infrastructure or internal systems.

It also said that, based on its investigation to date, no funds had been withdrawn. The company said a possible social-engineering attack involving information exposed in another company's data breach remained under investigation, but that the connection had not been confirmed.

It said it had introduced additional authentication and account-protection measures.WHAT ELSE DO WE KNOW?Moneycontrol reported other cases of unauthorised transactions, including one in which an investor alleged that $3.1 million (about Rs 29 crore) worth of securities were sold within two minutes, followed by the purchase of 30.5 lakh shares of a thinly traded stock.It also reported a Bengaluru FIR naming DriveWealth LLC, Stockal Securities, Borderless Softech Private Limited, Borderless Investing Inc. and HDFC Securities. The preliminary estimate of losses exceeding Rs 100 crore was based on investor accounts and is not a verified total.Several questions remain unanswered: who accessed the accounts, whether the September DriveWealth data breach was connected to the October transactions, why investors did not receive trade alerts, and whether all affected investors have got their original holdings back.

Until these issues are clarified, the scale of the losses and responsibility for the transactions remain uncertain.- Ends