Tabcorp, one of Australia's prominent gambling operators, has been fined €216,374 by the Victorian Gambling and Casino Control Commission (VGCCC) for failing to implement mandatory multi-factor authentication (MFA) on customer wagering accounts. This lapse, which occurred between January and June 2025, allowed unauthorized individuals to access certain accounts and withdraw funds.
MFA requires users to verify their identity through multiple authentication methods. Tabcorp finalized its MFA implementation in June 2025, at which point customers were also instructed to upgrade to a new version of the TAB app.
Chris O’Neill, chair of the VGCCC, stated, "We expect strong systems to prevent breaches and protect customers. If breaches occur, it is our expectation that licensees identify and resolve them quickly and address their underlying cause. Customer-protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services. This penalty reinforces to all gambling providers that they must fully implement and maintain those protections."
In 2024, Tabcorp faced a more substantial penalty from the VGCCC, amounting to €2.84 million (A$4.6 million). The latest fine serves as a reminder of the need for gambling providers to diligently uphold customer-protection measures.
