Security at a Melbourne train depot has been stepped up after vandals were able to start a train before it derailed and caused $3 million in damage.
A set of stolen or lost keys were likely used to start the train at the Hurstbridge holding yard on Melbourne's outskirts about 2am on Wednesday.
But the train didn't get far before security equipment derailed it and any plans for a joyride.
Metro chief Andrew Lezala says the trains can't start without a combination of keys, leading him to believe the vandals had access to a set possibly lost or stolen.
"I suspect, somehow, they gained access to a key," Mr Lezala told reporters in Hurstbridge on Wednesday.
"Presumably they accessed that through the black market."
He said a derailing device, used to stop rogue trains entering the main line, was activated after the train travelled 80 metres.
Security staff and cleaners saw the train roll, striking a second train and damaging fences.
The Rail, Tram and Bus Union says the incident could have been avoided if more surveillance staff were employed.
"Fifteen staff to fight vandalism across the entire network is clearly not enough," RTBU secretary Luba Grigorovich said.
Metro says it's already in discussions with Public Transport Victoria to start using electronic smart keys with a shelf life, meaning they could be cancelled if lost or stolen.
Police and transit detectives have canvassed the area for CCTV footage.