The Victorian regulator has fined Tabcorp for failing to meet the standards expected in customer protection by not having mandatory multi-factor authentication controls in place, designed to safeguard wagering accounts.
The Victorian Gambling and Casino Control Commission (VGCCC) found Tabcorp VIC P/L did not comply with four Wagering and Betting Technical Standards, during the period of 30 January to 23 June, 2025.
Multi-Factor Authentication (MFA) is a key security measure that requires more than one form of authentication in order to log into and access an account.
The time of non-compliance left its wagering and betting system vulnerable to attack and potential infiltration by outside parties.
As a result, some customer accounts experienced unauthorised access and money was withdrawn.
The gaming giant is accused of not meeting the required standards for a Wagering and Betting Licence holder, including swiftly rectifying any problems, and was fined $350,000.
“We expect strong systems to prevent breaches and protect customers,” says VGCCC Chairperson Chris O’Neill APM.
“If breaches occur, it is our expectation that licensees identify and resolve them quickly and address their underlying cause.”
Tabcorp advised the VGCCC that MFA was fully implemented in June 2025, which included requiring customers not using the upgraded version of the TAB app to switch to it.
Customers affected by unauthorised access have been reimbursed by their banks or by Tabcorp.
The VGCCC has not been shy about imposing significant penalties on Australia’s largest gaming company, last year directing Tabcorp to undertake broad reforms to strengthen its compliance systems, governance and harm-minimisation program and slugging the company $4.6 million for breaching spam laws.
O’Neill says the latest penalty was intended to reinforce the importance of customer security compliance and protect broader aspects of the industry.
“Customer-protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services.
“This penalty reinforces to all gambling providers that they must fully implement and maintain those protections.”
Further details on the decision can be found HERE on the VGCCC website.
