Fears have emerged that Myki vending machines could compromise the credit card security of thousands of public transport users, because of a flaw in how the machines issue receipts.

Passengers who decline a printed receipt after topping up at a vending machine with a credit or eftpos card are automatically issued one anyway, often unwittingly leaving behind a receipt that includes their full name, nine digits of their credit card and the card's expiry date. Passengers who accept a receipt are automatically issued two copies.

Myki top-up machines spit out customers' credit card details without their knowledge. Credit:Jessica Shapiro

The information on the receipts exceeds the guidelines that the Australian Securities and Investment Commission, and credit card companies, put in place to minimise the risk of unauthorised transactions.

The Transport Ticketing Authority admitted yesterday that the manner in which its Myki vending machines issue receipts is flawed and says it is working to fix the problem. The Age is not aware of any cases of fraud or information theft that have arisen from the flaw.