Tabcorp fined AU$350,000 by Victoria regulator over nearly five months without mandatory MFA

Tabcorp has been fined AU$350,000 (US$245,413) by the Victorian Gambling and Casino Control Commission (VGCCC) after failing to implement mandatory multi-factor authentication (MFA) across its wagering and betting system for nearly five months in 2025. For high-risk operators, the point is simple: if a local technical standard says MFA is mandatory, “alternative controls” are not much of a defence.

1. The VGCCC found Tabcorp in breach of multiple provisions of the Wagering and Betting Technical Standards Act, specifically sections 8.3.1, 8.3.2, 10.3.2 and 10.4.3. The commission’s view was that MFA is not just one possible control among many; under standard 8.3.1, it is required.
2. Mandatory MFA was missing across Tabcorp’s wagering and betting system for nearly five months in 2025, leaving customer accounts exposed to unauthorised access. MFA, in this context, means users must present two forms of verification, such as a password plus a one-time code, before account access is granted.
3. Tabcorp notified the commission on 20 January 2025 about a significant security breach involving unauthorised access to at least 195 customer accounts, with illicit withdrawals totalling approximately $308,099. Fourteen of those accounts had been accessed during the period when MFA was not implemented as mandated.
4. In May 2025, Tabcorp reported a bot attack against dormant accounts that did not have MFA protections. That incident led to around $13,471 being withdrawn from player accounts in Victoria, with total nationwide losses nearing $31,000. Both Tabcorp and customer banks reimbursed the affected individuals.
5. The VGCCC said the AU$350,000 penalty reflected the nature and seriousness of the breaches, the actual and potential harm to customers, the nearly five-month period of non-compliance and Tabcorp’s eventual cooperation. The commission described the breaches as “towards the lower end of objective seriousness,” but still treated the extended non-compliance and customer losses as aggravating factors. The fine was about 3.5% of the maximum penalty available under the Gambling Regulation Act.

Tabcorp argued that MFA had been made available to customers from March 2025, that detection systems had been in place for longer, and that the contraventions were brief and caused by technical limitations. The VGCCC acknowledged Tabcorp’s cooperation and reimbursements, but said the company did not fully accept responsibility for the breaches.

The July penalty follows telemarketing violations and is the second time in three months Tabcorp has been fined, after a separate action by the Australian Communications and Media Authority (ACMA). For PSPs and acquirers serving wagering, the message is not subtle: regulators will read technical standards literally, and account-security gaps turn into licensing and payments problems fast.