Public transport users warned of new scam of stealing cash from unregistered Myki cards

Thousands of public transport users are at risk of having their Myki cards hacked and funds stolen, with many Melburnians already victims of the scam.

Thousands of public transport users are at risk of being scammed after sophisticated swindlers figured out how to steal money from unregistered Myki cards.

In a massive blow to the trouble-plagued Myki system, insiders are warning that taxpayers will now be on the hook for refunds for people affected by the scam, as well as a costly fix, after it was discovered that there was a fault in the system that could be exploited.

The scam was discovered in late April after more than a dozen people came forward complaining about money being stolen from their cards or cards not working – however it is not known how long it has been operating.

It is believed the scammers have discovered a weakness in relation to the 15-digit Myki card numbers and were able to use Artificial Intelligence, or some kind of system, to identify card numbers that had not been registered.

They then register these card numbers under pseudonyms and steal the money already loaded on to the card by having it refunded into a bank account.

Commuters with unregistered Myki cards are being targeted by the scam. Picture: David Crosling

So far, only 14 cases have been proven to be involved in the scam but transport insiders said there was likely thousands of card numbers compromised.

There are 45 million Myki cards in use in Victoria and it’s possible many Myki users will not realise that their money is being stolen, sources said.

Public Transport Users Association spokesman Daniel Bowen said it was “alarming that scammers have figured out how to do this”.

“A lot of people don’t bother to register their Myki cards,” Mr Bowen said.

“The risk is they might be vulnerable to their account balance being stolen.

“The government really needs to look at what solutions can be found.”

He said more people should register their cards for the advantages, “particularly if you lose the card”.

“Some people don’t [register]. They’ll need to find a way to prevent this,” Mr Bowen said.

Public Transport Victoria identified the issue in late April but remained quiet publicly about the issue as it worked closely with Minister for Public and Active Transport of Victoria Gabrielle Williams’ office on how to deal with the issue.

The issues was identified in April this year — but kept quiet from the public. Picture: Paul Jeffers

A Victorian government spokesman said: “Victorians can rest assured that if any issues were identified with their cards, they would receive a refund. Of the more than 45 million myki cards issued, there have been just 14 reported cases where unregistered cards were incorrectly registered to new users – affected customers were contacted and will receive refunds of their last recorded myki balance, as well as the card fee to purchase a new myki card.”

If customers suspect that their Myki has been compromised, they are urged to contact Public Transport Victoria by calling 1800 800 007.

It is understood that the scam has also been reported to Victoria Police.

An email was on Friday being prepared to be sent to customers who had raised concerns saying an “issue” had been identified with their card and a refund offered.

There was no mention of a scam within the communication.

The latest issue comes after a new 15-year ticketing contract started on 1 December 2023 by Conduent Business Services who were chosen to modernise the system.