The regulator found that Tabcorp didn’t meet 4 Wagering and Betting Technical Standards between January 30 and June 23, 2025, and during this period, customers were still able to access some accounts without MFA, leaving them open to unauthorized access.
MFA requires customers to provide more than one form of verification when logging into an account, and although Tabcorp had started adding the security measure to its TAB app, customers using older versions weren’t required to upgrade straight away.
The VGCCC said some customer accounts were accessed without permission during the period, with money withdrawn from affected accounts. Tabcorp later completed the move to mandatory MFA in June 2025.
VGCCC chairperson Chris O’Neill commented:
“We expect strong systems to prevent breaches and protect customers. If breaches occur, it is our expectation that licensees identify and resolve them quickly and address their underlying cause. Customer-protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services.”
As a result, the operator told the regulator that affected customers had been reimbursed either by their banks or by Tabcorp.
The latest penalty adds to Tabcorp’s recent compliance record, as the operator was also fined A$4.6 million by the VGCCC in 2024 over repeated breaches of Victoria’s Responsible Gambling Code of Conduct and other license requirements.
