Tabcorp VIC Pty Ltd (Tabcorp) has been fined $350,000 for not implementing mandatory multi-factor authentication (MFA) controls designed to protect customer wagering accounts.

The Victorian Gambling and Casino Control Commission (VGCCC) found Tabcorp failed to comply with 4 Wagering and Betting Technical Standards between 30 January and 23 June 2025, leaving its wagering and betting system vulnerable because MFA had not been fully implemented.

MFA is an important customer security measure requiring more than one form of authentication before a customer can access their account.

During the period of non-compliance, some customer accounts were subject to unauthorised access resulting in money being withdrawn from these customer accounts.

VGCCC Chairperson, Chris O’Neill APM said Tabcorp had failed to meet the standards expected of the Wagering and Betting Licence holder.

‘We expect strong systems to prevent breaches and protect customers. If breaches occur it is our expectation that licensees identify and resolve them quickly and address their underlying cause,’ Mr O’Neill said.

Tabcorp has advised the VGCCC that full implementation, including requiring remaining customers to upgrade to a version of the TAB app incorporating MFA, was completed in June 2025. Affected customers have been reimbursed by their banks or by Tabcorp.

Mr O’Neill said the penalty was intended to reinforce the importance of compliance with customer-protection requirements.

‘Customer-protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services. This penalty reinforces to all gambling providers that they must fully implement and maintain those protections,’ Mr O’Neill said.

The VGCCC has previously imposed significant penalties and directed Tabcorp to undertake broad reforms to strengthen its compliance systems, governance and harm-minimisation capability, including a $4.6m fine in 2024.