Tabcorp fined by Victorian regulator over MFA failures

The Victorian Gambling and Casino Control Commission (VGCCC) has fined Tabcorp for failing to implement mandatory multi-factor authentication (MFA) across customer wagering accounts. The period of non-compliance lasted from late January to June 2025.

Due to the lack of these security controls, some customer accounts were subject to unauthorized access, resulting in the withdrawal of funds. Tabcorp has since reimbursed affected customers through the company or their respective banks. The company completed its MFA rollout in June 2025, which required customers to upgrade to a new version of the TAB app.

VGCCC Chairperson Chris O’Neill stated that the penalty is intended to reinforce the necessity of customer-protection requirements to safeguard users and maintain confidence in regulated wagering services. This follows a larger fine issued to Tabcorp in 2024 regarding spam law breaches.