My Accounts Frequently Asked Questions

1. How much does this service cost?
2. How are my account details kept secure?
3. What types and levels of encryption are you using?
4. My bank's terms and conditions say that I may not disclose my password to any other third party. Can I still use the My Accounts service?
5. Does Egoli or any other third party get to see my passwords at any time?
6. Does Egoli or any third party get to see my aggregated account data at any time?
7. How up to date is the information in my summary on My Accounts?
8. Why do you automatically sign me out after 60 minutes?
9. What information does this service store?
10. What happens if the Egoli site is attacked?
11. Can I use My Accounts from my work and home PCs?
12. What is a Portable Profile?
13. How does the Portable Profile work?
14. What happens if I upgrade my PC?
15. Is it safe to run My Accounts from a shared PC?
16. What happens if someone uses my PC?
17. What happens if someone finds out my My Accounts username and password?
18. What happens if I forget my My Accounts login details?
19. Clicking on the padlock at the bottom of my screen indicates that "This certificate has failed to verify for all of its intended purposes". Why?
20. What is your privacy policy?
21. Why do I need to upgrade my Microsoft Java VM?

1. How much does this service cost?

Egoli is currently offering My Accounts at no cost. Of course you are fully responsible for all ISP, telephone and related charges arising from the use of My Accounts.

2. How are my account details kept secure?

Your private details are stored encrypted on your PC using various industry standard encryption technologies including "3 key triple DES". Your institutions' login details are never sent to or seen by Egoli or any other third party.

Storing your institutions' details encrypted on your PC means that they are not available to anyone else. The key to decrypt the data is NOT stored on your PC, but on the eWise.com.au server. This means that even if someone steals or has unauthorised access to your PC they will not find the key on your PC so all they will have is data encrypted to a higher level (ie 168 bit triple DES) than the 128 bit encryption used when you manually use your browser to log in directly to your bank. In the unlikely event of someone compromising the eWise.com.au or Egoli servers, they will also not get access to your userids and passwords since they are not held and never even pass through the eWise.com.au or Egoli servers.

Your account details are kept secure because the communication occurs directly between your PC and each relevant institution in the same way as you would do if you logged into your institution manually through your browser. There is no third party intervention at all. This technology just makes your browser smarter and automates the process for you. You can even watch the process as it occurs and you will see how it works!

The service allows you to perform the account aggregation process directly from YOUR PC by YOUR PC logging in to your institutions and extracting the relevant data and presenting it to you in your browser. The process is initiated and controlled by you and YOUR data only travels between your institution eg Bank and YOUR PC. This happens in EXACTLY the same way as it would if you used your browser to manually log in to your institution (only much faster). The data is NEVER seen, stored or even passes through the eWise.com.au or Egoli servers.

3. What types and levels of encryption are you using?

The service uses various standard types of encryption techniques for various functions. In particular, this service uses "3 key triple DES" encryption with 3x56 = 168 bit keys to encrypt your data on your PC. We use SHA and 1024 bit RSA public encryption for internal security purposes. This service also uses 128 bit SSL for all communications.

4. My bank's terms and conditions say that I may not disclose my password to any other third party. Can I still use the My Accounts service?

Using the My Accounts service does not breach any terms and conditions of the institutions which you can access through us. You are not disclosing your password to a third party. You are simply having it encrypted and stored on your PC. Your password never gets sent to or seen by Egoli or any party other than your bank, when this service logs you into your bank.

5. Does Egoli or any other third party get to see my passwords at any time?

No - your passwords are never sent to or pass through Egoli or any other third party site.

6. Does Egoli or any third party get to see my aggregated account data at any time?

No - your aggregated account data is not sent to and does not pass through Egoli or any other third party site.

7. How up to date is the information in my summary on My Accounts?

As your information is live - retrieved in real time - it is as up to date as your institution maintains it. You should hit the Update Now button on your browser if you have been logged on for a while to ensure the information is as current as possible.

8. Why do you automatically sign me out after 60 minutes?

A number of institutions have automatic 'time-outs'. This is an added security feature (like screen-savers) so that if you leave your machine unattended, nobody can access your accounts. You should sign-out from My Accounts when leaving your PC.

9. What information does this service store?

Egoli does not know and does not need to know who you are. Egoli My Accounts ensures privacy of your account usernames and passwords by encrypting them and storing them on your PC. Egoli never has access to this information. Egoli only stores information provided by you: such as your Egoli username, the answer to your password security question, your email address, postcode and age group. To ensure that using Egoli My Accounts is as simple and effective as possible, whenever a page is requested from our server, we also record the time and date of the request as well as information on the browser software and online accounts that are being used. This information is used to improve the performance and functionality of Egoli My Accounts. This information is not used in any way to uniquely identify a user. This information is strictly confidential and all users remain anonymous.

10. What happens if the Egoli site is attacked?

It is a fact that hackers attempt to break into sites on the Internet. The Egoli site takes all the necessary security precautions to prevent such attacks from succeeding. In the unlikely event that a hacker does succeed in accessing the data on the site, they will not have compromised your usernames and passwords to your institutions since this information is NEVER kept in any form on our site. This information is always stored encrypted on your own PC and used directly between your PC and the relevant institution.

11. Can I use My Accounts from my work and home PCs?

The My Accounts Portable Profile feature (see below) allows you to use My Accounts from multiple PCs, such as those at your home and workplace.

12. What is a Portable Profile?

The Portable Profile feature allows you to save your private details onto a floppy disk or other removable device. This Portable Profile feature can be used to:
- back up your details
- transfer your details between machines or
- have your details available on another machine without having to re-enter them on that machine

13. How does the Portable Profile work?

- Saving details to floppy (or removable device)

We've added a "Save Profile To" option to the bottom of Step 2 on the My Profile page. This allows you to specify where your details will be saved, eg floppy disk. Previously this information was always saved in the digital safe on your PC.
Note: My Accounts currently only supports saving to floppy disk and USB removable storage devices such as IBM USB Disk on Key.

- Accessing details from a removable device

On the login page there is a new check box called "Use Portable Profile". If you select this check box the page is refreshed and lists the devices that can be read from. Select the device your details were saved to and then log in to My Accounts as you would normally. The My Accounts site operates normally however all account details and previous balances are now loaded / saved from / to the specified device.

- Copying details to a new PC

Copying details between PC's can now be performed using a removable device. Simply log into the My Accounts site as normal, go to the Profile Details page and save your profile information to a floppy disk. Next, go to the My Accounts login page on the new PC and select the "Use Portable Profile" check box. Select the floppy device and then log in. Proceed to the profile details page and then select "Registry" at the bottom of the page and click the "Save Profile" button.

14. What happens if I upgrade my PC?

Before upgrading your PC we recommend you follow the instructions provided above to back up your details using the Portable Profile feature. This will ensure you are able to restore your Profile settings in the event you experience difficulties using My Accounts after upgrading your PC.

15. Is it safe to run My Accounts from a shared PC?

It is safe as the logins that are on your PC are encrypted, provided you do not disclose your My Accounts login details to anyone.

16. What happens if someone uses my PC?

If they do not know your My Accounts username and password, they will not be able to access your accounts as they are encrypted on your PC. They could log in as themselves and set up the machine to store their My Accounts profile in addition to yours. There is no limit to the number of My Accounts users that can save their encrypted details on a specific PC.

17. What happens if someone finds out my My Accounts username and password?

You should immediately change your password by logging into My Accounts site. Without access to your PC the username and password will not compromise your data as your data is encrypted on your PC, not the My Accounts server. As an added precaution, you should also contact My Accounts (by sending an email to ) and request that your profile be reset. Note that for security reasons you will also be required to re-enter your institutions' details on your PC.

18. What happens if I forget my My Accounts login details?

Please notify My Accounts staff (by sending an email to ) and after we confirm your identity using the information you provide at registration, we will reset your details and provide you with a new username and password. You would then need to change your password the first time you log in to My Accounts. Note that for security reasons you will also be required to re-enter your institutions' details on your PC.

19. Clicking on the padlock at the bottom of my screen indicates that "This certificate has failed to verify for all of its intended purposes". Why?

The eWise security certificate is valid and your security has not been compromised in any way. A bug exists in Microsoft Internet Explorer 5.0 and 5.01 for Microsoft Windows 95, 98 and NT 4 which causes IE to return the error message "This certificate has failed to verify for all its intended purposes". More information about this bug can be found on Microsoft's Web site http://support.microsoft.com/support/kb/articles/Q233/4/79.ASP. As discussed on the Microsoft site, the problem applies to any Web site using Server Gated Cryptography. Clicking on the Certificate Path tab in the dialog box will confirm the certificate status is OK.

20. What is your privacy policy?

Please refer to the full My Accounts Privacy policy here.

21. Why do I need to upgrade my Microsoft Java VM?

The Microsoft Java VM is the program on your PC that allows Java applets to execute. To access and navigate Java based web sites eWise.com.au requires the Microsoft Java VM loaded on your PC to be at least version 5.0.0.3176. The latest Java VM can be downloaded by clicking here. The download is approximately 6MB in size.
Choose the "Run this program from the current location" option to automatically install the Java VM once it has finished downloading.
If you are required to upgrade your Java VM a message will appear on the My Profile details page and on the My Summary page when you try to access that site. The message contains the link above to allow you to download the latest Java VM.