Four Metro subway station attendants have been arrested and charged with embezzlement in connection with a major, continuing investigation into thefts from Farecard vending machines, Metro and court officials said yesterday.

Thefts from the machines may have totaled tens of thousands of dollars, officials said, and more arrests are possible.

The charges against the four attendants are all misdemeanors and involve thefts of less than $10. In the instances leading to the charges, marked money was placed in the machines and the machines were monitored on closed circuit television, according to D.C. Superior Court papers and Assistant U.S. Attorney Peter Kadzik.

Metro officials refused to comment yesterday beyond a cryptic three-paragraph press release. However, it was learned that Metro's Transit Police have started a major campaign to reduce theft of both small and large amounts of money from Farecard vending machines, particularly at five stations. Audit evidence has shown discrepancies between how much money should be in the machines and how much actually is there.

A single Farecard vending machine can contain more than $2,000 in change. Money sometimes falls to the floor of the machine through normal malfunction. It is also possible for an individual to cause the machine to spill change, according to informed sources.

Metro calls money on the floor a "spillover" while station attendants call it "jackpotting." Station attendants have specific instructions to call Metro's revenue collection office for assistance whenever they see money on the floor of a vending machine.

Station attendants regularly open the doors of the machines to free jammed dollar bills and Farecards from the mechanisms in the back of the door.

Kadzik, the U.S. attorney, said that Metro had been receiving one spillover report a day systemwide before the four attendants were arrested. Since then, he said, spillover reports have averaged 28 per day.

Rodney Richmond, secretary-treasurer of Local 689 of the Amalgamated Transit Union, which represents station attendants, said yesterday that "if they're stealing, they're stealing. But we don't think they should point the finger just at station attendants. Anybody who has a key can open that door."

Keys are held by station attendants, maintenance workers, supervisors and revenue collection teams. Keys and locks are changed periodically.

The four attendants have been arrested over the past six weeks; three have been arraigned in Superior Court.

They were identified in court records as Leonard Talbert, 38, of Southeast Washington, who works at the Farragut West Station; Roberts Lane, 30, the Dupont Circle station; James Robert Hall, 51, of McLean, the Metro Center station, and Tommy Vincent Henderson, 32, of Alexandria, the Farragut West station. All four employes have been suspended by Metro.

The estimate of tens of thousands of dollars in possible lost revenue comes from top Metro officials who ordered the investigations after they began to suspect that Metro's revenues were not matching its ridership. The problem of farebox theft is one that plagues the transit industry and ranks with the problem of fare evasion by some transit patrons.

The duties of station attendants have been a labor issue at Metro. Most station attendants are former bus drivers and many were here when a policy requiring riders to pay the exact fare was adopted by Metro's predecessor companies. The main purpose of that policy was to eliminate bus drivers and their changemakers as the objects of crime.

When Metro opened the Farecard system on July 1, 1977, it had many discussions with Local 689 leaders on work rules permitting station attendants to handle jammed dollar bills in the Farecard machines.