Stockal Row: Who Is Liable for the Unauthorised Sale of US Shares?

Stockal Dispute Puts Cross-Border Trading Accountability Under Scrutiny

The alleged unauthorised sales raise difficult questions about platform security, broker duties and investors’ routes to compensation.

The investigation has yet to establish how the orders were placed

The reported losses have brought the division of responsibilities between an Indian investing platform and an overseas broker into focus. Stockal provides the interface through which investors place orders, while DriveWealth is the US-based brokerage partner involved in executing trades and providing custody services. That arrangement can make it difficult for customers to identify which party controlled the part of the process that failed.

Stockal’s preliminary investigation reportedly found no evidence of a breach on its platform and suggested that email accounts or login credentials may have been compromised through phishing or social engineering. DriveWealth, in turn, has attributed security lapses to Stockal’s platform. These are competing positions, not established findings: the available account does not determine whether credentials were compromised or how the trades were authorised.

The distinction matters because an order passing through one firm does not, by itself, settle liability. The investigation would need to examine authentication, order transmission, execution, custody and each intermediary’s safeguards.

Liability may turn on duties and evidence—not just the trade route

Legal experts cited in the source say responsibility would depend on the respective roles of the Indian intermediary and US broker, their obligations to clients and where any security failure occurred. If inadequate authentication, cybersecurity or fraud detection on the platform contributed to the transactions, that could support a claim of negligence or deficient service. If the broker failed in its own execution, supervision or account-security responsibilities, its conduct could also be examined.

Agreements between the firms, including provisions allocating cybersecurity responsibilities or indemnifying one another, may affect their contractual dispute. But those arrangements do not automatically remove an investor’s independent legal options. Equally, an allegation that a customer’s credentials were compromised would not alone establish that the customer must bear the loss. The facts and the parties’ compliance with their respective duties remain central.

Indian safeguards may not cover every part of an overseas trade

SEBI-registered stockbrokers in India have obligations relating to client orders, transaction records, timely communication about execution or non-execution, and contract notes. The regulator’s cybersecurity and cyber-resilience framework also requires safeguards for broker systems and client information. These requirements may be relevant to the Indian intermediary’s conduct.

However, overseas investing is not identical to buying shares on an Indian exchange. The foreign broker, where the securities are held and the agreements governing the account affect which rules apply to each stage. SEBI registration of an Indian intermediary does not automatically place every action of its foreign partner under Indian regulation. That cross-border split may complicate both investigations and remedies.

Investors can pursue complaints, but recovery is not assured

Affected investors can first raise complaints with the platform. If the issue remains unresolved, they may approach SEBI through SCORES against a SEBI-registered intermediary and consider the regulator’s SMART ODR process for conciliation or arbitration. Any claim against the US broker may depend on the account agreements, including their jurisdiction, governing-law and arbitration terms.

Investors should preserve trade confirmations, account statements, platform communications and records of any disputed login or transaction alerts. Such material may help establish which trades were unauthorised and how the parties handled them. Compensation, however, will depend on evidence, applicable rules and contractual responsibilities; the existence of a complaint route does not guarantee recovery.

Key Highlights

• Nearly 30 investors allegedly suffered losses of more than ₹100 crore after US shares were sold without consent.
• Stockal and DriveWealth have made differing claims about where security lapses may have occurred.
• Responsibility may depend on authentication, order handling, custody, contractual duties and evidence.
• SEBI protections for Indian intermediaries do not automatically govern every action of a foreign broker.
• Investors may use platform complaints, SCORES and SMART ODR where applicable; recovery remains uncertain.

Investor Note: Investors using overseas trading platforms should understand which entities handle orders and custody, review the applicable account agreements, and retain transaction records. In this case, liability and the prospects for compensation remain subject to investigation and the relevant legal and contractual terms.