The Australian citizen of Afghan descent was taken into custody after a struggle at the scene of the incident.
The car the 32-year-old was driving hit a number of pedestrians on Flinders Street, a busy junction in the centre of the city, said Victoria Police.
Fourteen people have been injured, with several in a critical condition.
A second man, 24, was arrested after being seen filming the incident. He had a bag of knives with him, police added.
“It is now believed he had no links to the incident, however he is still assisting police with enquiries,” they said.
The driver was arrested by an off-duty police officer. Police say he was the only person in the car.
The officer sustained shoulder and hand injuries during the arrest and was taken to hospital.
The driver was also taken to hospital, under police guard.
The white SUV struck pedestrians just after 16:30 local time (05:30 GMT).
Witness Jim Stoupas, who runs a business nearby, told the BBC: “It just barrelled through a completely full intersection of pedestrians. There was no attempt to brake, no attempt to swerve.”
He added: “I saw probably five to eight people on the ground with people swarming around them [to help]. Within a minute, I think, there were police on site, so it was very, very speedy.”
Victoria Ambulance said in a statement that a child of pre-school age with serious head injuries was among those taken to hospital.
Another witness, Lachlan Read, told the Herald Sun the whole incident lasted about 15 seconds.
“He has gone straight through the red light at pace and it was bang, bang, bang. It was just one after the other,” he said of the moment the vehicle started hitting people.
Rossella Belardi told the BBC she was coming out of Flinders Street Station when she saw people running. “Many people were on the floor and smoke was coming out of the car.”
“Police and the ambulance service were incredible,” she added. “They came immediately out of nowhere.”
In January, six people died when a man drove a car into pedestrians on Bourke Street.
Afterwards, city authorities installed concrete blocks in various locations – including on Flinders Street – hoping to prevent vehicle-based attacks.
In September, a 15-year-old boy dressed in black combat gear was seen driving erratically down nearby Swanston Street.
After a confrontation with police he was subdued with a Taser outside Flinders Street Station. Police later said it was not a terrorist incident.