Australia’s sports betting operator Tabcorp VIC Pty Ltd has been fined AU$350,000 (US$246,243)
by the Victorian Gambling and Casino Control Commission (VGCCC) for failing to implement mandatory multi-factor authentication (MFA) controls designed to protect customer wagering accounts.
The regulator found Tabcorp breached four Wagering and Betting Technical Standards between 30 January and 23 June 2025, leaving its wagering and betting system vulnerable because MFA had not been fully implemented on online play.
MFA requires customers to provide more than one form of authentication before accessing their accounts. During the period of non-compliance, some customer accounts were accessed without authorization, with money withdrawn.
Tabcorp has advised the VGCCC that full implementation was completed in June 2025, including requiring remaining customers to upgrade to a version of the TAB app incorporating MFA. Affected customers have been reimbursed by their banks or by Tabcorp.
VGCCC Chairperson Chris O’Neill APM said Tabcorp had failed to meet the standards expected of the Wagering and Betting License holder. He said the Commission expects strong systems to prevent breaches and that licensees should identify and resolve any breaches quickly and address their underlying cause