Tabcorp, one of the largest gambling firms in Australia, has been penalized €216,374 by Victoria's gambling regulator for failing to enforce mandatory multi-factor authentication (MFA) on customer wagering accounts. An investigation by the Victorian Gambling and Casino Control Commission (VGCCC) revealed that from January to June 2025, Tabcorp neglected to implement the required MFA, which allowed unauthorized individuals to access certain accounts and withdraw funds.
MFA necessitates customers to verify their identity through multiple methods of authentication. Tabcorp completed its MFA implementation in June 2025 and subsequently required its users to update to a new version of the TAB app.
Chris O’Neill, the chair of the VGCCC, emphasized the importance of strong systems to avoid breaches and to protect customers. "If breaches occur, it is our expectation that licensees identify and resolve them quickly and address their underlying cause. Customer-protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services. This penalty reinforces to all gambling providers that they must fully implement and maintain those protections," he stated.
In 2024, the VGCCC had imposed a significantly larger fine of €2.84 million (A$4.6 million) on Tabcorp for similar issues. The commission reiterated that this latest penalty is meant to underscore the necessity for gambling operators to fully comply with customer protection measures.
