Latest disciplinary action against Tabcorp follows a previously imposed fine of A$4.6 million in 2024
Tabcorp has been fined A$350,000 in the Australian state of Victoria for failing to implement mandatory multi-factor authentication (MFA) controls designed to protect customer wagering accounts.
The Victorian Gambling and Casino Control Commission (VGCCC) said that Tabcorp failed to comply with four Wagering and Betting Technical Standards between 30 January and 23 June 2025, leaving its wagering and betting system vulnerable because MFA had not been fully implemented.
During the period of non-compliance, some customer accounts were subject to unauthorised access and withdrawals.
VGCCC chairperson Chris O’Neill said Tabcorp had failed to meet the standards expected of wagering licence holder in the state.
“We expect strong systems to prevent breaches and protect customers,” said O’Neill. “If breaches occur it is our expectation that licensees identify and resolve them quickly and address their underlying cause.”
Tabcorp has advised the VGCCC that full implementation, including requiring remaining customers to upgrade to a version of the TAB app incorporating MFA, was completed in June 2025.
Affected customers have been reimbursed by their banks or by Tabcorp.
O’Neill said the penalty was intended to reinforce the importance of compliance with customer-protection requirements.
“Customer-protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services,” he said. “This penalty reinforces to all gambling providers that they must fully implement and maintain those protections.”
The VGCCC has previously imposed significant penalties and directed Tabcorp to undertake broad reforms to strengthen its compliance systems, governance and harm-minimisation capability, including a A$4.6m fine in 2024.
Shares in Tabcorp Holdings Ltd (ASX:TAH) closed 0.55 per cent lower at A$0.91 per share in Sydney Friday.