Australian bookmaker Tabcorp has been fined $350,000 by the Victorian Gambling and Casino Control Commission for failing to implement mandatory multi-factor authentication controls to protect customer wagering accounts.
The breach ran from 30 January to 23 June 2025. During that period some accounts were subject to unauthorised access and funds were withdrawn. MFA is a baseline security standard requiring two or more forms of identity verification before granting account access.
VGCCC chair Chris O'Neill said the regulator expects wagering licence holders to maintain systems that prevent account compromise and respond quickly when incidents occur. The fine should remind all operators that full compliance with customer protection requirements is critical to trust in the regulated market, he said.
Tabcorp told the regulator that MFA rollout was completed in June 2025, when all remaining users were required to update the TAB app. Affected customers received reimbursement from their banks or from the company directly.
This is not the first major penalty for Tabcorp. Earlier in 2025 the regulator imposed a $4.6 million fine and ordered a full overhaul of the company's compliance and harm-minimisation systems. Before that the operator paid $2.7 million for telemarketing and spam violations.
