Tabcorp fined AU$350,000 over failure to implement multi-factor authentication

Dig Deeper

Related stories

2026/02/26: Tabcorp revenue rises to AU$1.344 billion in H1 despite digital turnover decline 2026/05/07: Tabcorp shares take AU$500 million hit amid money laundering investigation 2025/10/21: Tabcorp shareholders approve “outlandish” options deal for Chief Executive 2026/06/26: Australia’s Tabcorp and UK’s DAZN launch global sports entertainment platform ahead of World Cup Round of 32

The Backstory

Compliance pressure follows Tabcorp into another year

Tabcorp’s AU$350,000 fine in Victoria adds another compliance breach to a company already trying to convince regulators, investors and customers that its controls are improving. The Victorian Gambling and Casino Control Commission found the wagering operator failed to fully implement mandatory multi-factor authentication between Jan. 30 and June 23, 2025, leaving some online wagering accounts exposed to unauthorized access and withdrawals.

The penalty is relatively modest compared with some of Tabcorp’s recent regulatory setbacks. But the breach goes to the core of a modern wagering business: whether a licensed operator can protect customer accounts while shifting more of its activity to digital channels. Multi-factor authentication is a basic security measure in banking, payments and online gambling. The regulator’s finding that Tabcorp had not fully implemented it across online play underscores how technical compliance has become a frontline issue for gambling companies, not a back-office function.

Tabcorp told the regulator it completed full implementation in June, including pushing remaining customers onto a version of the TAB app that incorporated the controls. Customers affected by unauthorized access were reimbursed by banks or by Tabcorp. Still, the commission’s language made clear the issue was not just reimbursement. It was whether the holder of Victoria’s wagering and betting license had systems strong enough to prevent foreseeable harm and identify failures quickly.

A reform agenda already under scrutiny

The Victorian action comes after Tabcorp was hit in 2024 with a AU$4.6 million fine and directed to undertake broad reforms to strengthen compliance systems, governance and harm-minimization capability. That context matters. Regulators are no longer treating breaches by major wagering operators as isolated incidents. They are assessing whether companies have embedded durable controls across technology, products, culture and executive oversight.

Tabcorp’s challenge is that each new enforcement action risks undermining the argument that prior remediation has taken hold. The latest breach involved a discrete technical standard, but the regulator framed it as a customer-protection failure. In a wagering market where licensed operators argue they provide a safer alternative to offshore or illegal providers, weak account security cuts directly against a central policy rationale for regulation.

The company also faces federal scrutiny. In May, Tabcorp disclosed that AUSTRAC was investigating its compliance with anti-money laundering and counterterrorism financing obligations, a development that triggered a sharp market reaction. The announcement erased more than AU$500 million from the company’s market value, according to coverage of the AUSTRAC investigation and share-price slide. Tabcorp said the review was at an early stage and that all outcomes remained open, including no further enforcement action.

That investigation is separate from Victoria’s multi-factor authentication case, but together they show the breadth of Tabcorp’s regulatory exposure. Anti-money laundering controls, customer identity protections, account access and safer-gambling tools all depend on reliable data, strong technology and escalation processes that work in real time. Failures in one area can raise questions about the resilience of the wider compliance environment.

Digital ambitions collide with operational demands

The stakes are heightened because Tabcorp’s growth strategy depends on digital products, app engagement and new wagering formats. In the first half of the financial year, the company reported revenue of AU$1.344 billion and EBITDA of AU$217.4 million, even as digital turnover declined and active users fell 4.4% to 766,000. Its wagering revenue rose 1%, though it fell 2.5% when the Victorian license introduced in 2024 was excluded, according to Tabcorp’s first-half earnings report.

Those results showed a business with improving earnings discipline but continuing pressure in its core digital customer base. Cost reductions, sports betting growth and international wagering revenue helped offset weaknesses. But the decline in digital users highlights why the TAB app is central to Tabcorp’s future. Any account-security incident, particularly one involving unauthorized withdrawals, can damage trust in the same channel the company needs customers to use more often.

The company has also been preparing products intended to modernize its betting offer. It received a favorable ruling from the Australian Communications and Media Authority on its Tap in-play betting product, which allows customers to activate live betting by physically tapping a mobile device at a station inside a licensed venue. The ACMA found the model did not breach the Interactive Gambling Act’s restrictions on online in-play betting, potentially clearing the way for broader rollout subject to state approvals, as reported in the regulator’s review of Tabcorp’s mobile in-play betting product.

That ruling was commercially important because in-play betting is a valuable but tightly constrained category in Australia. It also illustrates the delicate line Tabcorp must walk. Product innovation can strengthen competitiveness against online rivals, but each new interface between customers, devices and venues adds compliance complexity. Regulators that approve new products are also signaling they will monitor how safeguards operate once those products scale.

Growth plans extend beyond traditional wagering

Tabcorp has sought to position itself not only as a wagering operator but as a broader sports entertainment business. Its partnership with DAZN Bet to launch WorldPlay, a global sports games platform tied to the World Cup, reflected that ambition. The product was framed as a free-to-play global tipping competition, with prize pools in Australia and several European markets, and potential expansion into other sports, subscriptions and fantasy-style formats. The launch was detailed in Tabcorp and DAZN’s WorldPlay partnership.

Free-to-play products can help gambling companies acquire customers, build engagement and test international sports experiences without immediately relying on regulated betting transactions. But they also bring reputational and governance questions, particularly when operated by companies whose main business is wagering. Data security, account verification, marketing boundaries and responsible-gambling controls remain central even when a product sits adjacent to betting rather than directly inside it.

That is why the Victorian fine carries significance beyond the monetary amount. Tabcorp’s ability to expand into new formats depends on confidence that it can manage the basics: secure access, protect customer funds and maintain systems that meet technical standards. Regulators are likely to evaluate future product proposals through the lens of past compliance performance, especially where mobile engagement is central.

Investors have rewarded the turnaround story

Despite regulatory headwinds, Tabcorp’s share price has recovered sharply over the past year, helped by cost-cutting, renegotiated contracts and plans to create a national tote by the 2026 financial year. That rebound has intensified focus on executive incentives. Shareholders recently approved another long-term options package for Chief Executive Gillon McLachlan, despite criticism from the Australian Shareholders Association, which described the arrangement as “outlandish,” according to coverage of the shareholder vote on McLachlan’s options package.

Governance questions around pay are not the same as regulatory breaches. But they intersect when a company’s valuation is tied to management’s ability to deliver a turnaround while reducing compliance risk. McLachlan’s mandate is to grow revenue, improve digital execution, cut costs and stabilize the company’s regulatory standing. The more investors reward future performance, the more visible each operational lapse becomes.

The latest fine therefore lands at an awkward point. Tabcorp is trying to show that it has greater depth in its business and a clearer strategy after years of structural change in Australian wagering. Yet it is also dealing with a string of regulatory matters, including ACMA penalties, AUSTRAC scrutiny and state-level enforcement. The company can point to reimbursement of affected customers and completion of the multi-factor authentication rollout. Regulators and investors will be watching whether that marks closure of a specific failure or another signal that deeper systems work remains unfinished.