Victorian Regulator Penalizes Wagering Operator Following Unauthorized Account Access and Fund Withdrawals
Tabcorp VIC Pty Ltd has been fined $350,000 by the Victorian Gambling and Casino Control Commission (VGCCC) for failing to implement mandatory multi-factor authentication (MFA) controls designed to safeguard customer wagering accounts. According to the VGCCC, Tabcorp failed to comply with four Wagering and Betting Technical Standards between January 30 and June 23, 2025, leaving systems vulnerable due to incomplete MFA implementation.
During this period of non-compliance, unauthorized individuals gained access to certain customer accounts and withdrew funds.
Regulatory Response and Remediation
VGCCC Chairperson Chris O’Neill APM emphasized that licensees are expected to maintain robust protective systems and swiftly resolve any underlying issues when breaches occur.
“Customer-protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services. This penalty reinforces to all gambling providers that they must fully implement and maintain those protections.”
Tabcorp informed the regulator that full implementation, including requiring remaining customers to upgrade to an MFA-enabled version of the TAB app, was completed in June 2025, and all affected customers have been fully reimbursed. This penalty follows previous regulatory actions against Tabcorp, which included a $4.6 million fine in 2024 alongside directives to reform compliance, governance, and harm-minimisation systems.
