Tabcorp, one of Australia’s largest gambling companies, has been fined €216,374 by Victoria’s gambling regulator due to failures in implementing mandatory multi-factor authentication (MFA) for customer wagering accounts. The Victorian Gambling and Casino Control Commission (VGCCC) discovered that from January to June 2025, Tabcorp did not roll out the required MFA, which resulted in unauthorized users accessing certain accounts and withdrawing funds.
MFA requires users to verify their identity through multiple methods before accessing their accounts. While Tabcorp completed its MFA rollout in June 2025 and upgraded customers to a new version of the TAB app, the delay in implementation raised significant concerns.
Chris O’Neill, the chair of VGCCC, emphasized the importance of strong security systems to prevent breaches and protect customers. He stated, "If breaches occur it is our expectation that licensees identify and resolve them quickly and address their underlying cause. Customer protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services. This penalty reinforces to all gambling providers that they must fully implement and maintain those protections."
This fine follows a much larger penalty imposed on Tabcorp in 2024, totaling €2.84 million (A$4.6 million). The VGCCC reiterated that strict adherence to customer-protection controls is essential for all gambling providers.
