Tabcorp has been fined AU$350,000 ($295,000) over customer-account security failures that left some betting accounts exposed to unauthorized access and withdrawals.
The Victorian Gambling and Casino Control Commission (VGCCC) imposed the penalty on Tabcorp VIC Pty Ltd. In its September 21st decision, the regulator found the operator breached four technical standards between January 30th and June 23rd, 2025.
The breaches concerned multi-factor authentication (MFA), which requires more than one form of identity verification to access an account. Tabcorp made the feature available in March 2025, but some customers could continue using older versions of its app without it.
Although 99 percent of customers had adopted MFA by April 1st, 2025, it was not mandatory for all customers until June 24th, when Tabcorp required users to upgrade the TAB app.
The remaining gap exposed some dormant accounts to a bot attack reported in May 2025. Tabcorp said the attacker used login credentials likely obtained from the dark web. About AU$31,000 ($22,000) was withdrawn nationwide, including AU$13,471 ($9,567) from Victorian accounts.
The decision also detailed unauthorized access to at least 195 customer accounts, from which AU$308,098.91 ($219,000) was withdrawn. Of those customers, 14 were affected during the period covered by the fine; the others were affected while regulatory dispensations were in place.
Affected customers were reimbursed by their financial institutions or Tabcorp.
The regulator had granted Tabcorp several extensions to implement MFA, with the final dispensation ending on January 29th, 2025. It rejected a further request in February.
In its response to the disciplinary notice, Tabcorp argued that alternative security controls met the standards and that any non-compliance ended when MFA became available in March. It also cited technical challenges.
The commission rejected those arguments, describing them as an ‘unduly narrow and technical interpretation’ of the company’s obligations. It found that MFA was required for compliance.
In setting the penalty, the VGCCC acknowledged the technical difficulties, customer reimbursements and resources devoted to implementation. It placed the breaches toward the lower end of seriousness and found no deliberate disregard of regulatory obligations.
However, it said Tabcorp’s history of non-compliance warranted a larger penalty than would otherwise have been appropriate. That history included a fine of AU$4.6 million ($3.27 million) against the group’s former Victorian licensee in 2024 for responsible gambling failures.
