Tabcorp fined $350,000 after failures allowed unauthorised withdrawals

Tabcorp has been fined $350,000 after failing to require all customers to use multi-factor authentication to access their betting accounts, leading to some accounts being accessed without permission and money being withdrawn.

The Victorian Gambling and Casino Control Commission (VGCCC) found Tabcorp broke four Wagering and Betting Technical Standards between January 30 and June 23, 2025. The regulator announced the fine on Thursday.

Tabcorp had been granted multiple periods of dispensation from the requirement, the regulator said. But some accounts were still accessed without permission and money was withdrawn.

Tabcorp told the VGCCC it had finished putting multi-factor authentication in place in June 2025. Remaining customers were required to upgrade to a version of the TAB app incorporating multi-factor authentication.

The regulator said affected customers were repaid by their banks or Tabcorp. It did not say how many accounts were accessed or how much money was taken.

Multi-factor authentication asks customers to prove who they are in more than one way before logging in, rather than relying on a password alone.

VGCCC chairperson Chris O’Neill said the failure fell short of the standards required of wagering and betting licence holders in Victoria.

“We expect strong systems to prevent breaches and protect customers. If breaches occur it is our expectation that licensees identify and resolve them quickly and address their underlying cause,” O’Neill said.

In April 2023, after major data breaches in Australia, the VGCCC urged gambling operators to check the security of online accounts. It recommended extra login checks and monitoring for suspicious activity.

O’Neill said the $350,000 penalty was intended to reinforce the requirement for operators to maintain customer security measures.

“Customer-protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services. This penalty reinforces to all gambling providers that they must fully implement and maintain those protections,” he said.

The MFA case is separate from the VGCCC’s $4.6 million penalty against Tabcorp Wagering (Vic) Pty Ltd, announced in August 2024.

That case concerned responsible gambling failures between August 2020 and February 2023. The regulator found Tabcorp had sent marketing to a customer who had opted out and had failed to help a customer showing signs of gambling harm.

The VGCCC also ordered Tabcorp to improve how it protects customers, follows the rules and oversees its betting shops.

The regulator has also fined other bookmakers over separate customer-care breaches: QuestBet $80,000 in 2025 for taking bets from a customer showing signs of distress and VicBet $130,000 in 2025 for offering a bonus bet after a customer asked to close an account and sending promotions to a self-excluded customer. The VGCCC imposed a $100,000 fine on OkeBet in 2024 for offering prohibited inducements to members of community sporting clubs to open betting accounts.