Victoria's gambling regulator VGCCC has fined Tabcorp AU$350,000 for failing to implement mandatory multi-factor authentication on its betting platform for nearly five months in 2025, leaving customer accounts exposed.
Tabcorp notified the commission of a breach on 20 January 2025. At least 195 accounts were accessed without authorisation, with illegal withdrawals totalling around $308,099. Fourteen accounts were compromised during the period when MFA was absent. In May 2025 a botnet targeted unprotected dormant accounts, draining approximately $13,471 in Victoria and nearly $31,000 across Australia. Customers were reimbursed by Tabcorp and their banks.
VGCCC found Tabcorp in breach of sections 8.3.1, 8.3.2, 10.3.2 and 10.4.3 of the technical standards. The regulator rejected the operator's arguments that MFA was not mandatory or that alternative measures were sufficient. The penalty represents roughly 3.5% of the maximum available under gambling regulation law. The commission noted Tabcorp's cooperation and reimbursement of funds but said the company had not accepted full responsibility.
This is the second major penalty for the operator in 2025. In July it was fined more than $2.7 million for telemarketing and spam violations over a sixteen-month period. A month ago Tabcorp acquired BetMakers for approximately $267 million.
