Victoria's gambling regulator fined Tabcorp VIC Pty Ltd $249,000 for breaching four technical standards between 30 January and 23 June 2025. The violations concerned multi-factor authentication.
Tabcorp rolled out MFA in March 2025, but some customers continued using older app versions without mandatory two-factor verification. By 1 April, 99% of users had migrated to MFA, but the feature became compulsory for all only on 24 June when the operator forced an update of the TAB app. The remaining security gap enabled a bot attack on dormant accounts reported in May 2025. Attackers used credentials believed to have been purchased on the darknet. Across Australia, $31,000 was withdrawn, of which $13,471 came from Victorian accounts.
At least 195 accounts were compromised, with $308,098 withdrawn in total. Fourteen customers were affected during the period covered by the fine; the rest during a regulatory grace period. All losses were reimbursed by banks or Tabcorp itself.
The regulator had extended Tabcorp's MFA deadline several times; the final extension expired on 29 January 2025. A February request for another deferral was rejected. Tabcorp argued that alternative security measures met the standards and that the breach ended with the March MFA launch. The commission dismissed those arguments as 'an unduly narrow interpretation of obligations'.
In setting the penalty, the regulator considered technical difficulties, customer reimbursement and implementation resources. But it noted that Tabcorp's compliance history warranted a tougher response — in 2024 the group's previous Victorian licensee was fined $4.6 million for responsible-gambling failures.
