The Victorian Gambling and Casino Control Commission has fined Tabcorp A$350,000 for failing to fully implement mandatory multi-factor authentication on customer wagering accounts. The regulator found four breaches of its Wagering and Betting Technical Standards between Jan. 30 and June 23, 2025, a period in which some accounts were accessed without authorization and money was withdrawn from them.
Tabcorp had been granted several temporary dispensations from the MFA requirements between August 2024 and Jan. 29, 2025, after telling the regulator it was running into technical problems with the rollout. When the company asked for another extension covering Jan. 30 to March 7, the VGCCC turned it down on Feb. 6 and put Tabcorp on weekly reporting instead. The operator then stayed non-compliant for almost five more months.
At least 195 customer accounts were compromised in a single incident reported to the regulator in January 2025, with $308,098.91 withdrawn. Fourteen of those customers were hit during the period covered by this disciplinary action, and there were 31,000 nationwide, with $13,471 from Victorian accounts.
MFA adoption had reached 99% by April 1, though customers could still log in through older versions of the TAB app that lacked it. Full implementation only came on June 24, when the remaining users were forced to upgrade to an app version with MFA built in. Customers who lost money to unauthorized withdrawals were reimbursed either by Tabcorp or by their financial institutions.
Tabcorp disputed the regulator’s reading of the technical standards after receiving a show-cause notice in April 2026. MFA had been available since March 2025, the company argued, other security controls covered some of the requirements, and any non-compliance ended once the feature was on offer. The VGCCC rejected all of that, saying MFA had to be enforced as a mandatory control rather than simply made available as an option.
The VGCCC placed the breaches toward the lower end of objective seriousness, then raised the penalty because of Tabcorp’s compliance history. The length of the failure and the real customer losses counted against the operator, while the regulator weighed the technical difficulties, Tabcorp’s reporting, the reimbursements, and the absence of any deliberate disregard for its obligations in its favor. The 350,000 fineworks out to about 3.5% of the 9.88 million maximum available in the case.
This is far from Tabcorp’s first penalty from the same regulator, which fined it $4.6 million in August 2024 for repeated responsible gambling failures and 1 million in 2023 for failing to comply with regulatory directions. The VGCCC also issued several letters of censure over other failures during 2023 and 2024, including unapproved software and direct marketing sent to customers who had chosen to take a break from gambling.
Federal regulators have gone after Tabcorp twice this year as well. The Australian Communications and Media Authority imposed a $158,400 penalty in February after the company accepted 426 prohibited online in-play bets across 32 tennis matches, then fined it more than $2.7 million in July over unlawful telemarketing calls and more than 217,000 marketing messages sent to customers who had unsubscribed.
The VGCCC also factored in Tabcorp’s $2.6 billion in group revenue and $391.5 million in EBITDA for the 2025 financial year when setting the fine. The company’s size and track record justified a penalty big enough to deter further non-compliance, the regulator said, and MFA is now fully in place across Tabcorp’s Victorian wagering operation.