Tabcorp, a major player in Australia's gambling industry, has been fined €216,374 by the Victoria’s gambling regulator due to failures in implementing multi-factor authentication (MFA) on customer wagering accounts. The Victorian Gambling and Casino Control Commission (VGCCC) conducted an investigation which revealed that from January to June 2025, the company did not have the necessary MFA in place, allowing unauthorized access to some accounts that resulted in funds being withdrawn by these users.
MFA is a security measure that requires users to verify their identity using multiple methods. Although Tabcorp completed its MFA deployment in June 2025 and rolled out an updated version of the TAB app, the period of non-compliance raised significant concerns.
Chris O’Neill, chair of the VGCCC, stated, “We expect strong systems to prevent breaches and protect customers. If breaches occur it is our expectation that licensees identify and resolve them quickly and address their underlying cause. Customer-protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services. This penalty reinforces to all gambling providers that they must fully implement and maintain those protections.”
This recent fine is not Tabcorp's first encounter with regulatory penalties; in 2024, it faced a much larger fine of €2.84 million (A$4.6 million) from the VGCCC. The latest penalty further emphasizes the necessity for gambling operators to maintain robust customer-protection controls.
