Ticket #367269 — Zerodha Support Portal

👤 Client [name redacted] Sep 16, 2026 02:36

Client ID: FG••••37 Logged in via Kite: YES Article: Blocked due to suspicious activity Category: Others kite

On 15-09-2026, three BUY orders were executed in my account (client ID FG••••37) at 09:15:10 without my knowledge. I was asleep until 10:00 AM and did not log in to Kite or place any orders. Orders I did NOT place (all: NIFTY2691523450CE, MIS, LIMIT @ 103.40, 65 qty each, 195 qty total): 1) Order ID 2098395320206532608 - 15-09-2026 09:15:10 2) Order ID 2098395323545198592 - 15-09-2026 09:15:10 3) Order ID 2098395326028226560 - 15-09-2026 09:15:10 These 195 qty were auto squared off by RMS on 15-09-2026 at 15:26:13 at Rs 0.20 (SELL order ID 2099799440972931093, placed by ADMINSQF), resulting in a loss of approximately Rs 20,124. TOTP 2FA is already enabled on my account. I have no active GTTs, SIPs, alerts or baskets that could have placed these orders. I request: 1. Order source details for the three 09:15:10 BUY orders - application/platform used and the login session (IP address, device, location) that placed them. 2. Login history of my account for 15-09-2026. 3. Investigation of unauthorised order placement/access in my account, and blocking of any connected Kite Connect/API/third-party apps. 4. Copy of the RMS auto square-off logs for the day. I have not authorised anyone to trade on my behalf. Please treat this as a report of unauthorised transactions in my account and confirm next steps.

kite-orders-15sep.png

System Sep 16, 2026 02:36

Thank you for reaching out to Zerodha. Your ticket has been created, and our team will respond within 24 working hours. Your ticket reference number is 367269.

Sep 16, 2026 12:05 Shrikanth

Thank you for writing to Zerodha. As per your query, we would like to inform you that we can see that you placed an intraday AMO order on September 13. Hence, the order was triggered on September 15. However, the intraday position was not squared off. Since intraday positions are required to be squared off on the same day, the open position was squared off by the RMS team. Please refer to What are the auto square-off timings for open intraday positions? You can update this ticket if you have any concerns or queries, and we will get back to you. Please note: This ticket will auto-close after 24 hours of inactivity, but you can reopen it at any time or reach out to us via our Support Portal.

👤 Client [name redacted] Sep 16, 2026 13:38

Please provide the timings of when this order was submitted and which IP it came from. Thanks.

👤 Client [name redacted] Sep 16, 2026 14:46

also why is the order time showing 15th and not 13th?

WhatsApp-Image-2026-09-16-at-2.46.05-PM.jpeg

Sep 16, 2026 15:33 Shrikanth

Thank you for writing to Zerodha. As per the above query, we would like to inform you that the AMO order was placed on September 13th and was sent for execution on September 15th. We can see that the order was placed through the Kite web platform. Accordingly, the order was placed on September 13th, while it was sent to the exchange for execution on September 15th. Hence, the execution details are reflected as of September 15th. You can update this ticket if you have any concerns or queries, and we will get back to you. Please note: This ticket will auto-close after 24 hours of inactivity, but you can reopen it at any time or reach out to us via our Support Portal.

ohist.xlsx

👤 Client [name redacted] Sep 16, 2026 16:02

Thank you. The AMO mechanics (created 13-09, sent to exchange 15-09) are understood and are not the concern. The disputed fact is that I did not create these orders and was not logged in at 06:30 on 13-09. You now state the order was placed via the Kite web platform. Please provide the specifics of that session: 1. The login/session that created the orders on 13-09-2026 around 06:30:56 IST: IP address, device/OS/browser (user-agent) and approximate location. 2. The matching TOTP/2FA success event for that login: was it completed, and from which device? 3. Full login history from 12-09-2026 to 15-09-2026: every session with IP, device and time (earlier I requested only 15-09). 4. All three orders show Created At 06:30:56.044, .048, .055, i.e. within about 11 milliseconds of each other. Through which Kite web screen was that done (basket? multiple tabs?), and please provide the order audit/request IDs for all three. 5. The list of connected Kite Connect / third-party apps on my account as of 13-09; if any API token was active, the app name, api_key and token issue time. 6. Confirmation that the RMS square-off at 15:26:13 was triggered by the position's loss/margin, per policy, and not by any action or inaction of mine. For context: TOTP 2FA is enabled, and I have no active GTTs, SIPs, alerts or baskets. If your logs show a web session at 06:30:56 on 13-09, I need the IP/device to determine whether it was mine. To my knowledge it was not. The placement of these orders is the event under dispute. Please do not close the ticket on the AMO-timing explanation alone.

Sep 16, 2026 17:50 Shrikanth

We are working on your ticket. We will get back to you with the resolution. We request your co-operation and patience in this matter. Please get in touch with us if you need any other information through our Support Portal.

👤 Client [name redacted] Sep 17, 2026 14:01

Hello. Any update on this ticket? I haven't received an update since yesterday.

Sep 17, 2026 15:53 Shrikanth

We are working on your ticket. We will get back to you with the resolution. We request your co-operation and patience in this matter. Please get in touch with us if you need any other information through our Support Portal.

Sep 17, 2026 21:17 Shrikanth

Thank you for writing to Zerodha. As per your query, we would like to inform you that since you have enabled TOTP (Time-based One-Time Password), a temporary code is generated every 30 seconds, providing enhanced security compared to traditional SMS or email OTPs. Please note that TOTP authentication is required to log in to Kite once it has been enabled on your account. Since TOTP is enabled, you cannot log in to Kite without TOTP. Therefore, we request you to kindly confirm whether you have shared your Kite login credentials with anyone. Additionally, Zerodha sends an email alert when log in from a new city or IP address. This alert helps ensure that you are notified of any possible unauthorized access and helps maintain the security of your account. Zerodha also sends a mobile notification through the Kite app for such login activity. Have you received any email alert regarding a login from a new city or IP address? If you share your login credentials with anyone, please reset your password. Intraday positions are required to be squared off on the same day. If you do not close your intraday F&O position, it will be squared off at 3:26 PM. See What are the auto square-off timings for open intraday positions? Please get in touch with us if you need any other information through our Support Portal.

👤 Client [name redacted] Sep 18, 2026 14:16

I have not received any new alert regarding new login. Please provide me the details I have requested.

Sep 18, 2026 14:34 Sridevi

We are working on your query. Kindly give us some time to check and assist you further. Please get in touch with us if you need any other information through our Support Portal.

Sep 21, 2026 09:23 Sridevi

Thank you for writing to Zerodha. We are transferring your query to the concerned department. You can expect a response in the next 24 to 48 hours. Please get in touch with us through our Support Portal if you need any other information.

Sep 21, 2026 11:21 Shrikanth

We are working on your ticket. We will get back to you with the resolution. We request your co-operation and patience in this matter. Please get in touch with us if you need any other information through our Support Portal.

Sep 21, 2026 17:40 Shrikanth

Thank you for writing to Zerodha. As per the above query, we would like to inform you that all orders were placed through the Kite web platform. We have not observed any unusual login attempts or suspicious activity associated with your account. If you believe that the orders were placed by someone else, we recommend changing your password as a precautionary measure and filing a cybercrime complaint with the concerned authorities. We will share the details with the police/cybercrime authorities. You can update this ticket if you have any concerns or queries, and we will get back to you. Please note: This ticket will auto-close after 24 hours of inactivity, but you can reopen it at any time or reach out to us via our Support Portal.

👤 Client [name redacted] Sep 21, 2026 20:02

This is nonsense reply. Please give me the details I requested or else I am posting this entire ticket on X and reddit.

How can I block my Zerodha account due to suspicious activity? - (Ticket #367269)Open