MORE than 1.1 million Myki cards are set to be phased out as hackers have found a method of cloning the tickets.

Myki manufacturers NXP has recommended users upgrade to the newer, 2008 swipecard, the MIFARE DESFire EV1. The Transport Ticketing Authority has said it will replace Myki with the more secure card, but has not said when.

TTA financial reports state the authority has $22.8 million worth of tickets in stock — which could include metcards and single-use Mykis — but this figure was written down this year to $8.1 million after the decision to scrap short term Myki tickets worth $14.1 million.

German engineering academics David Oswald and Christof Paar, both from Ruhr Universitat Bochum, have been studying how to hack into the card and claim their research forced NXP to discontinue the Myki card. The scientists are studying the cards as part of their cryptography research.

Mr Oswald said the duo have been researching hacks for the newer EV1 card but ‘‘so far, we could not find any similar problem for this card’’.

TTA chief executive Bernie Carolan said the hacks didn’t force the authority to replace the cards.

He has assured the public ‘‘don’t need to worry about the security of their Myki card.’’

‘‘There is no reason to assume any cards will become wasted or inoperable,’’ he said.

Mr Carolan said transport users are safe because Mykis hold limited information — only the card balance and the last 10 transactions. No personal information is held on the card.

‘‘The TTA, through its contractor Kamco, has already begun developing a migration strategy to a newer version of chip, the MIFARE DESFire EV1,’’ Mr Carolan said.

But Mr Oswald said under certain circumstances a reprogrammed card can be used to gain a free ride on public transport. But security measures may mean the card can be used only once before it’s banned from use, he said.

He said cards can be cloned at home and the process took seven hours, but could be reduced to three or fewer with practise and better expertise. The cloning equipment costs about $3000.

He said with the current method, cards can’t be cloned in public, on a bus for instance, but that Mykis are readable from about 25 centimetres away.

NXP has said its newer EV1 card is still compatible with older card readers.

Mr Carolan said the value on cards can not be increased using this method.