Scammers are using an exploit to access myki payment cards and steal money from Victorian commuters, Public Transport Victoria (PTV) says.

PTV, which operates trains, trams and buses across the state using a payment system called myki, confirmed to the ABC that at least 14 people have had money taken out of their accounts by scammers.

Daniel Bowen from the Public Transport Users Association said scammers are able to exploit a vulnerability in the registration system.

PTV currently allows commuters to register their myki cards online or via phone using the 15-digit number printed on each card.

"A lot of people who use myki don't register their cards, and it appears that this may leave them vulnerable to this scam," Mr Bowen said.

"The scam appears to happen when scammers work out that cards are unregistered, and register it to their name and claim a refund."

Mr Bowen said that registering a myki card appeared to prevent scammers from exploiting the loophole.

Only a few cases had been reported so far, but Mr Bowen urged the government to act before it became a wider-scale issue.

Trials are due to begin this year to allow debit and credit cards to be used on Victoria's public transport, with the transition away from myki cards expected to take two years.

A July 2023 report revealed that a proposed trial to allow Victorian public transport users to tap on using a credit card or phone instead of a myki card was knocked back three years ago by the government.

In a statement, the government said additional safeguards had been put in place and that anyone experiencing issues would receive a refund.

"Of the more than 45 million myki cards issued, there have been just 14 reported cases where unregistered cards were incorrectly registered to new users," a government spokesperson said.

"Affected customers were contacted and will receive refunds of their last recorded myki balance, as well as the card fee to purchase a new myki card."

Shadow Minister for Transport Matthew Guy criticised the government for its slow progress in moving on from the myki system.

"It's fine to have shiny, new bridges and new trains but when you've got a ticketing system that's from the 1990s that's now compromising people's data, it's time to actually focus on that as a priority," Mr Guy said.

If anyone suspects their myki has been compromised, they are urged to contact Public Transport Victoria by calling 1800 800 007.