VGCCC Fines Tabcorp AU$350,000 Over MFA Security Failures
Australia.- 25 September 2026 | www.zonadeazar.com The Victorian Gambling and Casino Control Commission, VGCCC, has fined Tabcorp VIC Pty Ltd AU$350,000 for failing to fully implement mandatory multi-factor authentication, MFA, controls across customer wagering accounts.
The regulator found that Tabcorp breached four Wagering and Betting Technical Standards between January and June 2025, leaving its system exposed to additional security risk.
AU$350,000 Penalty
The regulatory penalty totals AU$350,000.
The VGCCC determined that the wagering licence holder had not complied with four technical standards applying to its Victorian operation.
Period of Non-Compliance
The breaches occurred between 30 January and 23 June 2025.
During that period, MFA had not been fully implemented for every relevant customer account.
What MFA Does
Multi-factor authentication requires more than one method of verification before an individual can access an account.
Alongside a password, this can involve:
- A mobile verification code.
- An authentication application.
- Additional identity confirmation.
- Another independent security factor.
The purpose is to reduce the risk of account compromise even when passwords are stolen.
Four Technical Standards Breached
The VGCCC found breaches of four Wagering and Betting Technical Standards.
Those requirements form part of the technical and security obligations imposed on Victoria’s wagering licence holder.
Customer Security Risk
According to the regulator, Tabcorp’s incomplete implementation increased vulnerabilities across its wagering and betting system.
The concern extended beyond theoretical exposure.
Unauthorised Account Access
During the period of non-compliance, some customer accounts were accessed without authorisation.
Money was subsequently withdrawn from certain affected accounts.
Customers Reimbursed
The VGCCC confirmed that affected customers were reimbursed.
Compensation was provided either by customers’ banks or directly by Tabcorp.
Full Implementation Completed
Tabcorp told the regulator that full MFA implementation was completed in June 2025.
The process included requiring remaining customers to upgrade to a version of the TAB application incorporating the security control.
Previous Dispensations
The VGCCC also noted that Tabcorp had been granted multiple periods of dispensation.
Despite those extensions, the operator had not completed implementation across all relevant customers within the required timeframe.
Licensee Responsibility
The regulator said wagering operators are expected to maintain strong systems capable of preventing breaches and protecting customers.
Where incidents do occur, licensees are expected to identify and resolve them promptly and address the underlying causes.
Chris O’Neill
VGCCC Chairperson Chris O’Neill APM said the regulator expects strong systems to protect customers and prevent security failures.
He also stressed that operators must respond quickly when breaches occur.
Confidence in Regulated Wagering
The regulator said customer-protection requirements also help maintain confidence in regulated wagering products and services.
Security controls therefore form part of the broader integrity of the licensed market.
Security as Compliance
The penalty highlights that cybersecurity and account-access controls are regulatory obligations rather than simply internal technology matters.
Failure to implement required systems can lead directly to enforcement.
Victorian Wagering Licence
Tabcorp operates under Victoria’s Wagering and Betting Licence.
The current 20-year licence was awarded in December 2023 and took effect in August 2024.
Licence Scope
The licence allows wagering on:
- Racing.
- Sport.
- Other approved events.
It also covers approved simulated racing products known as Trackside.
Technical Standards
The regulatory framework requires systems used by the licence holder to comply with specific standards relating to security, integrity and customer protection.
Account authentication forms part of those requirements.
Account Takeover Risk
MFA plays a particularly important role in preventing account takeover.
Such attacks can allow unauthorised users to:
- Access personal information.
- Change account details.
- Place transactions.
- Withdraw funds.
Financial Protection
For wagering accounts, a security compromise can quickly lead to financial losses.
Strong authentication is therefore a key customer-protection control.
VGCCC Enforcement
The latest action follows several previous VGCCC enforcement measures involving Tabcorp.
The regulator has previously directed broader reforms covering compliance, governance and harm minimisation.
AU$4.6 Million Fine in 2024
In August 2024, Tabcorp was fined AU$4.6 million for separate breaches relating to its Responsible Gambling Code of Conduct and licence obligations.
The latest case is distinct and focuses specifically on technical customer-security requirements.
Wider Enforcement Powers
The VGCCC can respond to regulatory breaches through measures including:
- Financial penalties.
- Censure.
- Licence variations.
- Suspension.
- Cancellation.
- Court proceedings.
Technology Compliance
The case reinforces the growing importance of technology compliance within regulated gambling.
Areas under increasing regulatory scrutiny include:
- Authentication.
- Cybersecurity.
- Data protection.
- Transaction monitoring.
- Access management.
- Incident response.
Customer Protection
The VGCCC said the penalty is intended to reinforce expectations across the entire market.
Gambling providers must fully implement and maintain all mandatory protections.
Partial Implementation Is Not Enough
The decision also illustrates that incomplete deployment of a mandatory control may still constitute non-compliance.
If some customers remain outside the required security framework, exposure can continue.
Industry Context
The increasing digitisation of wagering is making account security more important across regulated markets.
As more deposits, wagers and withdrawals are completed through mobile applications, regulators are placing greater emphasis on identity and authentication controls.
Next Steps and Impact
Tabcorp has advised that full MFA implementation has already been completed and affected customers have been reimbursed.
The VGCCC will continue monitoring compliance with its technical and customer-protection standards.
The AU$350,000 penalty reinforces the message that digital security controls are a core part of Victoria’s wagering framework and that incomplete implementation can result in enforcement even after the underlying weakness has been corrected.
Editó: @fonta
