Stockal shock: How a suspected cyber attack may have put crores in Indian investors’ US stock holdings at risk

Over the past few years, many Indians have started investing in overseas stocks as fintech platforms, working with brokers, have enabled customers to buy and sell shares in US-listed companies. This has opened the door for ordinary Indians to invest in blue-chip stocks such as Amazon, Apple, Microsoft and Nvidia, among others.

Now, however, some investors using Stockal Securities allege that their US stock holdings were liquidated without their authorisation or any alerts and that the proceeds were then invested in thinly traded or illiquid securities. The transactions have raised concerns about possible trading fraud.

Stockal Securities is a Bengaluru-based fintech registered with the Securities and Exchange Board of India. Such fintechs partner with US-based clearing brokers to enable Indian investors to buy stocks and exchange-traded funds (ETFs) listed on US stock exchanges.

Investors can also buy fractional shares of US stocks, a significant advantage for those looking to invest in large-cap and mega-cap companies.

Some investors allege that their Stockal accounts were accessed without their knowledge on October 15, their holdings were sold and the proceeds were invested in illiquid securities. A report has alleged that the resulting losses could be as high as ₹100 crore. One investor alleged that they received neither an alert nor a trade confirmation when the transactions took place.

Stockal, rebranded as Borderless in 2025, said 26 accounts appeared to have been accessed using valid login credentials. In 13 of those accounts, the company said existing large-cap US equity holdings were sold and the proceeds used to purchase thinly traded microcap securities. No funds were withdrawn, it added.

“Our investigation has found no evidence of a breach or compromise of the Borderless platform, interface, infrastructure or internal systems. We believe the affected account holders may have been victims of a social engineering attack involving information exposed in another company's data breach several weeks earlier.

However, this connection remains unconfirmed and under active investigation,” it said.

Stockal has engaged independent cybersecurity specialists to examine its systems. The company said its teams have been in direct contact with affected customers since shortly after the incident. It is also working closely with DriveWealth, the US-based broker, to establish the facts, review the transactions and explore appropriate avenues for a fair resolution.

“Based on information reviewed to date, the identified unauthorised trading was confined to the 13 accounts described above. We have found no evidence of threats to the wider Borderless platform, other products or other customer accounts,” it said.

A key question remains: if, as the company says, its platform was not breached, how were multiple individual accounts accessed without authorisation at the same time? This will need to be investigated.

Meanwhile, the fintech has put in place additional authentication and account-protection measures for its customers.

The incident is another wake-up call about growing cybersecurity risks. Personal data was reportedly leaked last month at State Bank of India, India’s largest lender. Last week, there was a reported $6.3 billion hack at cryptocurrency exchange Binance. As digital transactions increase and our digital footprint expands, stronger safeguards are needed.