Victoria’s gambling regulator fined Tabcorp A$350,000 after finding that mandatory multi-factor authentication controls had not been fully implemented.
Tabcorp VIC Pty Ltd has been fined A$350,000 after Victoria’s gambling regulator found that the operator had not fully implemented mandatory multi-factor authentication controls for customer wagering accounts.
The Victorian Gambling and Casino Control Commission announced the penalty on 24 September 2026. Its official decision summary says Tabcorp failed to comply with four Wagering and Betting Technical Standards between 30 January and 23 June 2025.
Some accounts were accessed and money was withdrawn
Multi-factor authentication requires an additional check beyond a password before access is granted. Depending on the system, that can involve an app confirmation, temporary code or another independent authentication factor.
The VGCCC said the incomplete implementation left Tabcorp’s wagering and betting system vulnerable. During the period of non-compliance, some customer accounts were accessed without authorisation and money was withdrawn.
The regulator did not publish the number of affected accounts or the total amount removed in its media release. It said affected customers were reimbursed either by their banks or by Tabcorp. Tabcorp advised the regulator that full implementation was completed in June 2025, including requiring remaining customers to upgrade to a version of its app that incorporated MFA.
The fine relates to failing to meet the technical standards, not to a finding that every account without MFA was compromised. The distinction is important: the security gap created the exposure, while the regulator separately confirmed that unauthorised access occurred in some cases.
The penalty follows earlier compliance action
The VGCCC said the A$350,000 penalty was intended to reinforce the importance of maintaining customer-protection controls. It also pointed to earlier action against Tabcorp, including an A$4.6 million fine in 2024 and directions aimed at strengthening compliance, governance and harm-minimisation systems.
For players, MFA matters because wagering accounts can hold personal information, payment details and withdrawable balances. A reused or stolen password may be enough to access an account when no second factor is enforced.
Security responsibility is shared. Operators must implement the controls required by their licences and technical standards. Customers can reduce exposure by enabling every available authentication feature and using a password that is not shared with email, banking or other gambling accounts.
What it means for players
Check the security section of every wagering account and enable MFA rather than waiting for it to become compulsory. Review recent logins, payment methods and withdrawal history, and change the password immediately if an unfamiliar transaction or device appears.
If money has been removed, contact the provider and payment institution promptly, preserve screenshots and reference numbers, and follow the escalation steps in our player disputes guide. Our payment guides explain why the return route and account ownership details also matter when a withdrawal is challenged.
The VGCCC action shows that security features are not merely optional convenience settings. Where a regulator has made MFA mandatory, incomplete deployment can become both a customer-loss issue and a licensing-compliance failure.
