VGCCC Fines Tabcorp AUD 350,000 Over Missing MFA Controls in Victoria

Victoria’s gambling regulator has fined Tabcorp AUD 350,000 (about $256,000) after finding that the operator failed to implement mandatory multi-factor authentication (MFA) controls in its wagering and betting system. For PSPs and high-risk operators, the point is simple: customer-security controls are not optional paperwork, and regulators will price the gap.

1. According to the Victoria Gambling and Casino Control Commission (VGCCC), Tabcorp failed to comply with four Wagering and Betting Technical Standards between 30 January and 23 June 2025. The regulator said the incomplete implementation of MFA left the wagering and betting system vulnerable.
2. VGCCC Chairperson Chris O’Neill APM said Tabcorp had not met the standards expected of a holder of a Wagering and Betting Licence. He stressed the need for strong systems to prevent breaches, protect customers, and identify and fix issues promptly, including the underlying causes.
3. The regulator said this was not Tabcorp’s first breach in Victoria. In August 2024, Tabcorp was fined AUD 4.6 million (about $3.23 million) for responsible gambling failings, including inadequate staff training and failing to provide appropriate support to a customer showing signs of gambling-related harm.
4. Tabcorp told the VGCCC that full implementation of MFA was completed in June 2025, including requiring remaining customers to upgrade to a version of the TAB app incorporating MFA. Customers affected by unauthorised access were reimbursed by their banks or by Tabcorp.
5. This is the second penalty Tabcorp has picked up this year. In July, the Australian Communications and Media Authority (ACMA) fined the operator more than AUD 2.7 million (about $1.9 million) for multiple breaches of spam and telemarketing laws, including thousands of marketing messages sent without meeting Australian spam requirements.

Tabcorp said in its FY2026 report last month that revenue rose slightly and EBITDA grew by double digits, while its acquisition of BetMakers Technology remains a near-term priority. So the fines are real, but they do not appear to have changed the company’s appetite for growth.