Stockal Scam: 13 Accounts, $6.26 Million Unauthorized Trades – Borderless Blames DriveWealth

On November 6, Bengaluru‑based fintech Borderless, the parent of Stockal Securities, pushed back against the media hype that suggested dozens of investors had collectively lost over ₹100 crore. In reality, the company says the breach touched just 13 customer accounts and involved roughly $6.26 million (about ₹58.8 crore) worth of trades.

The trouble began on October 15, during US market hours, when Stockal’s US‑broker partner DriveWealth flagged suspicious activity. Within minutes, Borderless froze the affected accounts to stop any further movement. According to the statement, an unauthorised third party used valid login credentials to enter 26 accounts, but only half of those saw actual trades – large‑cap holdings were sold and the proceeds used to buy thinly‑traded micro‑cap securities.

Borderless insists no cash was ever withdrawn from the accounts. What did happen was a rapid liquidation of US blue‑chip stocks, which naturally shook the portfolios of the 13 investors involved. The company emphasizes that the $6.26 million figure reflects the purchase value of the unauthorized trades, not the final loss after market swings.

Why did this happen? Borderless points to a massive cybersecurity incident at DriveWealth in September 2026. That breach exposed personal data of customers across many platforms – from Revolut in Europe to Stake in Australia and Hatch in New Zealand. Unfortunately, some of Stockal’s Indian users were among those whose credentials were compromised.

In its November 4 notice, Borderless wrote that the similarity between the September data leak and the October unauthorised trades was “striking.” The firm also notes that internal and independent audits found no weakness in its own systems – the vulnerability lay squarely with DriveWealth’s infrastructure.

Earlier reports on November 3 suggested nearly 30 investors had lost more than ₹100 crore. Borderless now corrects that narrative, stating the number of affected accounts is 13, not 30, and the monetary figure is $6.26 million, not ₹100 crore. The final impact on each investor’s portfolio will still depend on market movements and the eventual reconciliation of the unauthorized positions.

Regulatory bodies, including SEBI, have been informed, and Bengaluru police have opened a probe, summoning senior executives from both Borderless and DriveWealth. As investigations continue, the fintech community watches closely, hoping for clearer answers and stronger safeguards for cross‑border investors.