Tabcorp, one of Australia’s largest gambling companies, got fiend by the Victoria’s gambling regulator over €216,374. The regulator found out that the operator failed to implement mandatory multi-factor authentication across customer wagering accounts.
The investigation led by the Victorian Gambling and Casino Control Commission (VGCCC), found that between January and June 2025 Tabcorp had not implemented the required multi-factor authentication, which led unauthorized users to subsequently access some accounts and withdrew funds.
MFA requires customers to verify their identity using more than one authentication method. Tabcorp completed its MFA rollout in June 2025 and required customers to upgrade to a new version of the TAB app.
Chris O’Neill, chair of the Victorian Gambling and Casino Control Commission, said:
We expect strong systems to prevent breaches and protect customers. If breaches occur it is our expectation that licensees identify and resolve them quickly and address their underlying cause. Customer‑protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services. This penalty reinforces to all gambling providers that they must fully implement and maintain those protections
Tabcorp received larger fine from VGCCC in 2024 in size of €2.84 million (A$4.6 million).
The commission said the latest penalty reinforces the requirement for gambling providers to fully implement and maintain customer-protection controls.