Australian racing and wagering firm Tabcorp has been hit with a AU$350,000 (US$246,000) fine in Victoria for “not implementing mandatory multi-factor authentication (MFA) controls” for its customer wagering accounts.
The Victorian Gambling and Casino Control Commission (VGCCC) indicated on Thursday that the period of discrepancy ran between 30 January and 23 June 2025, “leaving its wagering and betting system vulnerable because MFA had not been fully implemented.”
The authority said that during the period, some money was withdrawn from the customer accounts as they “were subject to unauthorized access.”
Tabcorp quickly responded to the VGCCC, noting that an upgraded version of its app had been implemented in June of last year and that “affected customers have been reimbursed by their banks or by Tabcorp.”
Despite the remediation, VGCCC Chairperson Chris O’Neill noted that the penalty is aimed at reinforcing the importance of compliance, stating, “This penalty reinforces to all gambling providers that they must fully implement and maintain those protections.”
The VGCCC flagged within its investigation report that the commission found that some of Tabcorp’s submissions “appear not to acknowledge its non-compliance” on certain technical standards and that “the Commission is not confident that Tabcorp appreciates the substance and purpose of the MFA requirements and the consumer protection outcomes they are designed to provide.”
The authority noted in its report that the Commission “expects Tabcorp to accept accountability for non-compliance, demonstrate that it is genuinely contrite and remediate its breaches as a matter of priority.”
Australia’s strict regulatory framework has been the topic of much discussion recently, including at the IAG Academy Summit, where numerous panelists commented on the strong approach being taken.
Tabcorp was previously issued a AU$4.6 million (US$3.2 million) fine in 2024 in regard to compliance, having subsequently undertaken what it described as “broad reforms.”
RelatedPosts
