Stockal investors allege unauthorised sale of US stocks worth millions

Nearly 30 Indian investors allege that someone entered their Stockal accounts without permission. Their US blue-chip shares were sold, even though they had not authorised those trades. The proceeds were then used to buy shares of Zhibao Technology, a little-known company trading as ZBAO. The allegation matters because investors lost control of valuable holdings through an intermediary platform.

One senior official reported that stocks worth $335,768 were sold. The money was converted into 300,000 ZBAO shares at $1.05 each. ZBAO later fell to $0.42, leaving that investor with losses of about Rs 4.26 crore. Other complaints describe a similar pattern across accounts.

Stockal said valid login credentials were used and blamed phishing attacks. DriveWealth, the US brokerage holding the accounts, disputed that explanation and pointed to weaknesses at Stockal. Investors have complained to Indian and US regulators and Bengaluru police, but responsibility remains unresolved.

The reported incident involved nearly 30 Indian investors, while Stockal said intruders accessed 26 accounts. The article describes the combined value of the allegedly sold blue-chip holdings as millions of dollars. It does not provide a final total for all investors’ losses, so the overall damage cannot be calculated from the available figures.

A senior official provides the clearest example. Shares worth $335,768 were sold and converted into 300,000 ZBAO shares at $1.05 apiece. When ZBAO fell to $0.42, the investor’s loss was estimated at around Rs 4.26 crore. This example shows how forced concentration in one volatile stock magnified the harm.

The figures remain allegations reported by affected investors, not a final adjudicated loss figure. Complaints have been filed with SEBI, the SEC, and Bengaluru police. The dispute between Stockal and DriveWealth may affect how the losses are assessed and who is held responsible.

Phishing is a deception technique used to obtain sensitive information, such as usernames, passwords, or verification details. An attacker may pretend to be a trusted company or service and direct someone to provide information through a fake message or website. The article identifies phishing as Stockal’s explanation for the account breaches.

If attackers obtain valid login credentials, they may be able to sign in to an investment account. If the account accepts those credentials without blocking the session, the intruder can view holdings, sell shares, and submit buy orders. The trades may initially appear authorised because the system recognises a genuine username and password.

Stockal said intruders used valid credentials to access 26 accounts. DriveWealth disputed that explanation and pointed to security weaknesses at Stockal. The article does not establish how the credentials were obtained or whether additional security controls were bypassed, so the exact mechanism remains contested.

Zhibao Technology Inc. is the little-known company whose shares were allegedly purchased after investors’ blue-chip holdings were sold. Its trading ticker is ZBAO. The unusual feature was not simply the stock choice, but that the same type of purchase reportedly occurred across multiple affected accounts without consent.

One investor’s $335,768 in sold holdings was converted into 300,000 ZBAO shares at $1.05 apiece. ZBAO later fell to $0.42, producing an estimated loss of around Rs 4.26 crore for that investor. A thinly traded stock can be harder to buy or sell without affecting its price, increasing price and liquidity risk.

The reported purchases therefore exposed investors to a little-known, sharply declining holding instead of diversified blue-chip shares. Investors raised concerns that coordinated buying could inflate ZBAO’s price. The complaints, however, do not establish who profited or whether anyone organised the trades.

A thinly traded stock has relatively limited buying and selling activity. When many accounts place buy orders at once, those orders can consume available shares and move the market price upward. The rise may make the stock appear more attractive, even though it may reflect concentrated trading rather than broad investor demand.

In this case, investors said proceeds from forced sales were used to buy ZBAO shares across multiple accounts. Such coordinated buying could inflate the price of a small stock. If someone already held shares, a higher price could potentially give that person an opportunity to sell at a profit. The later selling could then leave other buyers with losses.

This is the basic concern behind a pump-and-dump scheme: demand helps push the price up, followed by selling that causes a fall. The article says the pattern is associated with such schemes, but the complaints do not establish who profited or whether a scheme actually occurred. Investigators would need to determine intent, control, and trading benefits.

Stockal connects Indian investors with US stock trading, while DriveWealth is the US brokerage partner that holds the accounts. A trade can therefore involve several stages, including account access, order submission, custody, and settlement. Responsibility may depend on which company operated each stage and what safeguards it was expected to maintain.

Stockal said intruders used valid login credentials and attributed the breaches to phishing attacks that compromised customers’ details through deception. DriveWealth disputed that explanation and instead pointed to security weaknesses at Stockal. The two accounts describe different possible sources of the problem, even though investors experienced the same unauthorised sales and purchases.

That disagreement affects investigations, compensation claims, and regulatory responsibility. If credentials were stolen through customer deception, questions may focus on account protection and authentication. If a platform weakness enabled access, attention may shift toward Stockal’s systems. The article does not resolve the dispute. Investors have complained to SEBI, the SEC, and Bengaluru police.

When an Indian app connects investors to a US brokerage, protection can involve both countries’ rules and the contracts governing each company’s role. The Indian platform may handle the customer relationship and access to the service, while the US brokerage may hold the investment account and process or settle trades. The exact protections depend on those arrangements.

In this case, Stockal is the platform and DriveWealth is the US brokerage partner holding the accounts. The article says investors complained to SEBI, the SEC, and Bengaluru police. Those complaints reflect the cross-border nature of the dispute, but they do not by themselves determine which body must compensate investors or decide every claim.

Jurisdiction may depend on where the firms operate, where the alleged failure occurred, and which rules cover the relevant conduct. Stockal blamed phishing, while DriveWealth pointed to Stockal security weaknesses. Because that disagreement remains unresolved, the article leaves open how responsibility will be divided and which regulator will provide the final remedy.