Borderless Investing is under investigation following unauthorized trading on its Stockal platform, with investors alleging losses exceeding ₹100 crore. While the company denies any internal system breach, citing potential social-engineering attacks, a formal FIR has been registered. The incident has raised questions about account security and the chain of custody for cross-border investments.
Borderless Investing, the operator of the investment platform Stockal, is facing legal and regulatory scrutiny after an incident where multiple user accounts were accessed without permission. The event, which occurred on October 15, 2026, involved unauthorized third parties using valid login credentials to enter 26 customer accounts. In 13 of these cases, the unauthorized users liquidated existing positions in large-cap US equities and used the proceeds to purchase shares of Zhibao Technology, a thinly traded microcap security.
Following these trades, affected investors have filed formal complaints, with some reports alleging total losses exceeding ₹100 crore. A First Information Report (FIR) has since been registered in Bengaluru, naming DriveWealth LLC, Stockal Securities, Borderless Softech, and Borderless Investing as parties in the case. The involvement of various entities reflects the complex structure of cross-border investing, where technology platforms like Stockal facilitate trades that are ultimately executed and cleared by US-based brokerage partners like DriveWealth.
Borderless Investing has formally denied that its internal systems were breached. The company maintains that the unauthorized access was likely the result of social-engineering attacks—such as phishing or credential harvesting—that compromised individual user details rather than the platform’s core security infrastructure. In response to the incident, the firm has engaged independent cybersecurity experts to audit its systems and has introduced stronger authentication measures to verify user access.
Amid these developments, HDFC Securities has clarified its position to stakeholders. The brokerage confirmed that its business partnership with Stockal ended in July 2024. HDFC Securities explicitly stated that it is not named as an accused party in any FIR related to the ongoing investigation, distancing its operations from the current dispute.
The incident serves as a significant monitorable for investors using cross-border investment platforms. The reliance on multiple intermediaries—including technology providers, local brokers, and foreign clearing partners—can create complexity when security incidents occur. For investors, the primary takeaway involves the importance of maintaining strict digital hygiene, including the use of multi-factor authentication (MFA) and ensuring that login credentials for financial platforms are kept secure and not shared.
The next steps for stakeholders will depend on the findings of the ongoing investigations by law enforcement and regulatory bodies in India and the United States. Investors may track further updates on the legal proceedings, the status of the cybersecurity audits, and any changes in the operating protocols implemented by Borderless Investing to prevent future account compromises.