Stockal investors allege unauthorised sale of US stocks worth millions

Nearly 30 Indian investors who trade US shares through Stockal Securities have reported unauthorised access to their accounts, alleging that their blue-chip holdings, worth millions of dollars in total, were sold off without their consent and replaced with shares in a little-known company that subsequently lost almost 60% of its value.

According to the complaints, the proceeds from the forced sales were used to buy shares in Zhibao Technology Inc., which trades under the ticker ZBAO.

One affected investor, a senior official, saw stocks worth $335,768 sold and converted into 300,000 ZBAO shares at $1.05 apiece. The share price subsequently fell to $0.42, putting his losses at around Rs 4.26 crore.

The pattern has alarmed investors, who point out that coordinated buying across multiple accounts could inflate the price of a thinly traded stock, a tactic associated with so-called pump-and-dump schemes. However, the complaints do not establish who, if anyone, profited from the trades.

Stockal has said that the intruders used valid login credentials to access 26 accounts, attributing the breaches to phishing attacks that allegedly compromised customers' login details through deception. DriveWealth, the US brokerage partner that holds the accounts, has disputed this explanation and instead pointed to security weaknesses at Stockal.

The affected investors have lodged complaints with the Securities and Exchange Board of India, the US Securities and Exchange Commission (SEC), and Bengaluru police. The disagreement between the two companies over the cause of the breaches has left investors uncertain about who is responsible for their losses.

The case also highlights risks for Indians investing in overseas markets through intermediary platforms. When a trade is made through an Indian app but settled by a US brokerage, questions can arise over the extent of investor protection, the division of responsibilities between the companies involved, and which regulator has jurisdiction to address grievances.