tws
A bunch of advice and tips from me:
Unlocked phone means carrier unlocked. in Best buy and also from reputable amazon sellers when it says unlocked you can trust that. The actual sub-model number of the phone also is indicative of which version a phone is and if its unlocked or not, so always ensure the sub-model number is listed in the description. If its not then don't buy.
I would have strongly advised you against buying a renewed google phone, but I don't know what you paid, if its of decent quality it might be worth it. Renewed phones are generally very bad and renewed google phones have pretty bad reliability reputation, even if directly RMAed to google. In fact google RMA is very bad apparently. Horror stories on youtube.
for buying a new phone I actually advise buying from bestbuy over buying from google. Buying from Bestbuy is more private (and cash option), very reliable, and often better prices than google itself.
Its better if you don't insert any SIM card into the phone before you install GOS. So Don't. You don't need it anyway.
When you get the new phone, before you install GOS, you need to turn the phone on, connect to the internet, go to settings, and enable "OEM Unlocking". This will allow you to install custom operating systems on the phone. This is explained the GOS installation manual.
Die Hard privacy tip: If you want to be VERY private and have google not figure out that this phone is "related to you" then you should not connect to your home wifi the first time you connect it to internet to enable OEM unlocking. If you do so, since you are on the original OS where google services have root access, then google can associate your IMEI and other hardware identifiers with your home IP and that can often give your exact identity to google. Once GOS is installed however then you can connect to your home wifi, and then its ok. If you don't want to bother with this, you don't have to.
To install GOS you need a chrome based browser (Brave will do) and you need an ORIGINAL and OFFICIAL cable. Otherwise you might run into trouble.
Once GOS is installed you can create additional users. Know that every new profile starts from the "default state" and therefore for each profile you have to go to settings and redo any and all changes you have made to the main (owner) profile. the settings and app customization don't carry over. Also know that the extra profiles are not exactly the same as the "owner" profile. The owner profile has access to ALL settings, but the extra profiles have limited access and some changes in "Settings" can only be done from the owner profile. There are a few other limitations on extra profiles relating to SMS and phone calls, but I don't recall them right now. You can search yourself.
To install your banking apps you might not need play store at all. So I recommend first try to install the banking app using Aurora (if you want to avoid google, and play store, and google accounts). If that doesn't work then you have a few options.
You can install all three Play components on a new profile, then you need to open the Play Store and go to the login/account creation page. You do not need to login or create an account. This causes the play components to get initialized. Once you have opened this page then you can close the page and close Play Store. Now you can go to settings and actually disable all 3 components without uninstalling them. This tricks most apps into thinking that Play component are available (because they are) without them running at all. So most apps that didn't work before now work and yet they can not communicate to google directly at all and Play is not active to gather any data on you or your apps. This also saves battery. To get your banking apps you can still get them from Aurora or APKmirror ( APKmirror not recommended, but still viable option). So this way you need no google account, and the apps work. Be advised that push notifications will not work in this mode because Play components are disabled.
If the banking app still doesn't work you may have to leave the 3 components enabled. But still don't login into a google account. At this point it would be extremely rare that the app wouldn't work.
However, some apps might absolutely REQUIRE that you be logged into Play Store with a google account. In this case you will have to use a google account. If the banking app is like this, I would actually recommend that you give it the "finger" and just don't install such an invasive and demanding app on your system, if you can. But some people absolutely need their app.
Some people cry foul over me recommending to download banking apps from Aurora citing that it not a "safe or Secure" path. Just to strand clear, I firmly disagree, but your choice.
Know that if you install Play components and they are running and have access to the internet, then if you install any app that is connected to your real identity (like a banking app or uber or food delivery app, facebook, amazon, whatsapp, etc), then this google play instance could technically get associated with your real identity even if you don't connect it to a google account. Any google account you login with will also get associated with your real identity through this Play instance. In case this is of relevance to you.
If it so happens that you have to have such apps installed on your phone, then you might benefit from combining them into the same profiles in smart ways. Although there are still some exception and some apps better still be isolated.
I hope this is of help to you.
Also read this post and the referred link inside it.
https://discuss.grapheneos.org/d/5267-basics/9