Wallet access uses at least two social logins over SSO. You pick from Google, Apple, X, or Telegram during wallet setup, and setup asks for two at least. Those dedicated social logins are the gates for transaction approvals. Google is a strong choice for wallet operations when you turn on Advanced Protection and keep the rest of your Bancoli access off those accounts.
Access to a social account does not, by itself, open your wallet. That is the point of the extra layers. Besides the social logins you use for wallet operations, someone still needs your Bancoli login and your MFA (Multi-Factor Authentication) code.
The real risk is putting every layer on the same account. If you use the same account to sign in to Bancoli, to create the wallet, and for Google Authenticator for your MFA codes, the layers become one. Wallet social accounts do not have to match your Bancoli business login, but it is better if they are different — keep your Bancoli sign-in off the accounts you use for wallet operations.
We recommend the steps below before you fund the account. Completing them does not change which Bancoli products, rails, or prices are available to you.
1. Keep the layers on different systems
Treat these as separate controls:
Your Bancoli login
The social logins used for wallet operations (at least two, chosen from Google, Apple, X, or Telegram)
Your Bancoli MFA code
Your wallet MFA code
Access is not the same as approval. Someone still needs to sign in with the wallet's social logins to approve a move. If only the two people who set up the wallet social logins have wallet access, only those two can move funds — even if many people have Bancoli seats. Do not assume a Bancoli seat equals wallet access.
2. Harden the social logins used for the wallet
A common setup is Google, with Advanced Protection turned on, plus a second provider for wallet operations — and a different method for the Bancoli login, such as LinkedIn or email. Keep MFA codes somewhere that is not only inside that same Google account.
If Google is one of your wallet social logins, turn on Advanced Protection. It requires a passkey or a security key to sign in. Someone who knows the password still cannot open the Google account without that key.
Before you enroll:
Turn on 2-Step Verification on the Google account.
Add a recovery email and a recovery phone.
Set up a passkey or a security key, plus one backup stored in a separate place.
Then enroll at Google Advanced Protection.
After enrollment:
Sign-in requires a passkey or security key.
Apps that use app passwords are blocked.
Only Google apps and verified third-party apps can access the account, and only with your permission.
If more than one person must sign wallet payments, enroll one signer first. Confirm they can still open the wallet and complete a low-value signed action. Confirm the recovery path. Then enroll the rest.
Wallet access may use any two of Google, Apple, X, or Telegram, not only Google. Harden every provider account you use as a wallet login, and prefer company-owned accounts over personal ones:
Google: turn on Advanced Protection (see above).
Apple: turn on two-factor authentication for the Apple ID, add a security key, and set a recovery contact and trusted phone number that is not SMS-only.
X: turn on two-factor authentication, use a security key rather than SMS, and review connected apps and active sessions.
Telegram: turn on two-step verification with a strong password, set a passcode, and review active sessions and devices.
If a provider offers a stronger protection tier, turn it on before the wallet holds a balance.
3. Clean up that Google account
Review the Google account you use for wallet operations before you send or receive live payments.
Use a recovery email that is not another Gmail address on the same Google account. Keep it company-owned if a team must recover access.
Review recent devices and sign-ins. Sign out of anything you do not recognize.
Remove old third-party apps that still have access to Gmail.
Turn off SMS as a Google sign-in method where you can. Use a passkey, security key, or authenticator app instead.
You can review this in Google account security.
Prefer a company-owned Google account if more than one person must sign payments. A personal founder Gmail means only that founder can complete the Google step.
What Bancoli will never ask for
Bancoli will not ask you for a Google password, a LinkedIn password, a passkey, or a one-time code by email or chat. If a message asks for those, do not reply. Sign in at app.bancoli.com or contact Bancoli Support through chat or a support ticket.
This page is about using Google well as one of your wallet social logins, and keeping it from becoming your only control. It is not a guide to Bancoli password reset, Bancoli MFA reset, or which payment methods appear after approval.