Australia’s VGCCC Fines Tabcorp for Customer Security Failures

Australia’s Victoria Gambling and Casino Control Commission (VGCCC) has fined Tabcorp, the country’s largest gambling company, AUD 350,000 (about $256,000) because it failed to implement mandatory multi-factor authentication (MFA) controls. Tabcorp Hit With Fine According to the VGCCC, between 30 January and 23 June 2025, Tabcorp failed to comply with four Wagering and Betting Technical Standards. This left its wagering and betting system vulnerable due to the incomplete implementation of multi-factor authentication. In its ruling, the VGCCC noted that this was not the first occasion on which Tabcorp had been found to have breached gambling laws and regulations in Victoria. In August 2024, Tabcorp was fined AUD 4.6 million (about $3.23 million) for several responsible gambling failings, including inadequate staff training and failing to provide appropriate support to a customer who was showing signs of gambling-related harm. VGCCC Chairperson Chris O’Neill APM said Tabcorp had failed to meet the standards expected of a holder of a Wagering and Betting Licence. He emphasised the importance of maintaining strong systems to prevent breaches, protect customers and ensure that any breaches are identified and resolved promptly, including addressing their underlying causes. According to O’Neill, the penalty was intended to reinforce the importance of complying with customer-protection requirements. He noted that these requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services, and emphasised that all gambling providers are expected to fully implement and maintain these protections. Tabcorp advised the VGCCC that full implementation of MFA was completed in June 2025, including requiring remaining customers to upgrade to a version of the TAB app incorporating MFA. Customers affected by the unauthorised access were reimbursed by their banks or by Tabcorp. It’s the Second Time This Year the VGCCC Fines Tabcorp It isn’t just the VGCCC that has fined Tabcorp this year. In July, the operator paid more than AUD 2.7 million (about $1.9 million) in penalties by the Australian Communications and Media Authority (ACMA) after it identified multiple breaches of spam and telemarketing laws. According to the ACMA, Tabcorp sent thousands of marketing messages without complying with the requirements of Australian spam laws. The regulator also identified numerous breaches of telemarketing rules relating to customer contact. That being said, it’s unlikely that these fines would make a huge negative impact on Tabcorp’s finances. Last month, the company published its FY2026 report, recording a slight increase in revenue and double-digit EBITDA growth. In addition, Tabcorp reiterated that its aim of acquiring BetMakers Technology will take center focus for the near future.