Tabcorp's $230K Wake-Up Call on Account Security

Dr. Annelies De Vos · 2026-09-24

When a gambling company gets slapped with a fine for not protecting its customers, it's worth paying attention. Tabcorp VIC Pty Ltd just learned that lesson the hard way—to the tune of A$350,000 (about $230,000 USD). The Victorian Gambling and Casino Control Commission didn't hold back after the company failed to fully roll out mandatory multi-factor authentication (MFA) for its wagering accounts. ### What Actually Happened? Between January 30 and June 23, 2025, some customers could still access Tabcorp's services without that extra authentication step. Think of it like leaving your front door unlocked because you meant to install a deadbolt but never got around to it. During that gap, unauthorized parties slipped into some accounts and withdrew funds. Real people lost real money—not because they did anything wrong, but because the system wasn't as secure as it should have been. Tabcorp eventually finished the MFA rollout in June 2025, requiring remaining customers to upgrade. But by then, the damage was done. The regulator made it clear: when you're handling people's money, "eventually" isn't good enough. ### Why MFA Matters More Than You Think Multi-factor authentication is like having two locks on your safe. Even if someone steals your key (your password), they still can't get in without that second code sent to your phone or email. Here's what MFA typically involves: - Something you know (password or PIN) - Something you have (phone, authenticator app, or hardware token) - Something you are (fingerprint or facial recognition) When companies skip or delay this step, they're essentially betting that a single password is enough. Spoiler alert: it rarely is. ### The Real Cost of Cutting Corners The A$350,000 fine stings, but the reputational damage might hurt more. Customers need to trust that their money and personal information are safe. When that trust breaks, it's hard to rebuild. For Tabcorp, the lesson is clear: compliance isn't optional, and timelines matter. For the rest of us? It's a reminder to check whether our own accounts—gambling or otherwise—have MFA enabled. If they don't, now's the time. As the saying goes, "Security isn't a product, it's a process." And sometimes, that process comes with a hefty price tag when you drag your feet.