A $9.99-a-week authenticator app: how a Vietnamese app factory turns a free tool into a subscription
What it is A two-step verification code app, with the same features as the free Google and Microsoft authenticators, but it auto-charges after a 3-day free trial. On iOS it's about $9.99 a week.
Why it took off Sites ask users to turn on two-step verification, so they search the store for "authenticator" and install whichever app has the closest name. The company spends heavily on Google paid acquisition and also runs an SEO site with 4 thousand-plus pages on "how to turn on 2FA." It proved out on iOS first, then moved the same code to Android.
DHow you could play it I wouldn't chase 2FA. What you can take is the playbook: pick tool categories where websites force the task, users are in a hurry, and the free options are unknown to ordinary people. Find languages or audiences the app factories haven't saturated yet, validate on iOS before porting to Android, and capture long-tail search with programmatic SEO.
- Data (updated daily) · first launch 2026-07-26 · 11-07 installs 354,915
Android · Total installs worldwide Data 2026-10-29 → 2026-11-07 (10 days, 10 observations). Google's detail page only refreshes install counts every other day, so a flat day doesn't mean nobody installed.Android · Ratings count (cumulative) Data 2026-10-29 → 2026-11-07 (10 days, 10 observations)
An authenticator app called "Authenticator App - 2FA" on Google Play has had 350k downloads in half a year and charts in the tool category's top grossing in 12 countries. It isn't a new indie creation. It's the same app that Vietnamese app factory iKame / Begamob got working on iOS, ported to Android. The product has nothing new. It makes money through three things: catching users who urgently need two-step verification, converting them through a trial that auto-renews, and paid acquisition on top. The playbook is easy to understand, but the spots for latecomers are already taken.
Aug 11, a one-star review from a company IT admin
2026 Aug 11: someone left a one-star review on this App's iOS version in the US store, titled "Misleading app!!". The reviewer runs IT at a company: "We had our staff install Microsoft Authenticator for work, and then a flood of angry tickets came in saying it wasn't free. Turns out people thought the Authenticator App was Microsoft Authenticator. Can't really blame them, since this app goes out of its way to make you think it's tied to Microsoft."
This review explains the whole thing. Nobody is specifically looking for it. Users are told by their company, Discord, a bank or an exchange to "turn on two-step verification and install an authenticator," so they search the store for the term and install the one at the top with the closest name. After install comes a 3-day trial (7-day trials have also been seen on iOS), then automatic charging when it ends. The price most mentioned in iOS reviews is $9.99 a week, about $40 a month (US App Store reviews, 2–October). The Android in-app purchase price is $5.99 to $49.99 (Google Play, 11-06).
What it is and who made it
The feature set is a standard TOTP authenticator: scan a QR code to add accounts, generate 6-digit codes offline, plus biometric lock, a password vault, and a private browser. That's all that Google Authenticator, Microsoft Authenticator, and the open-source 2FAS and Aegis offer, for free.
The developer is listed as "iKame Applications - Begamob Global," the Hong Kong entity of Hanoi-based iKame Group. This developer account has 18 apps with 324M installs combined, most of it from casting (Cast for Chromecast about 97.5M) and a document reader (about 94.2M) (Google Play, 11-06). Put simply, the company's skill is picking a tool category everyone needs, building an app that looks like the one you're searching for, and buying ads.
Earn money on iOS first, then move to Android
The iOS version, "Authenticator ℠ App," launched in Nov 2025 19. By Nov 6 it had about 6,600 ratings in the US store, with 275 new per week. Its best rank on the US Utilities top grossing chart was #7, #5 in the UK, #4 in Germany, and #6 in Australia (App Store, 11-06). Ranking that high on top grossing means its monthly revenue is considerable. The exact figure isn't public, and the rank alone can't give an accurate number.
The Android update notes contain only one line: "authenticator_kmp/production_v1.1.6." KMP is Kotlin Multiplatform, sharing one codebase across both platforms. iOS proved the numbers work for must-have + subscription + paid acquisition, and Android then gets a second revenue stream at almost no extra development cost.
The Android curve also looks like paid acquisition turned on and off with budget (Google Play cumulative installs; 5–October from third-party estimates):
| Timeline | Total installs |
|---|---|
| 2026-05-20 | About 16k |
| 8-10 | Passed 100K |
| 10-04 | About 250k |
| 11-06 | 354,915 |
From late August to mid-October, installs sometimes jumped 5 thousand to 14k in a single day. After late October they dropped back to 1,500–2,000 a day. The growth comes in steps rather than creeping up through word of mouth, which looks more like budget being raised and cut based on payback (inferred). It currently ranks #16–23 on the Philippines tools top grossing chart, around #47 in Australia, and around #80 in the US, with no rank on the free chart (Google Play, 10-29 to 11-06). Play rating 4.4, about 4,900 reviews.
Where users come from
- Paid acquisition, confirmed. Begamob runs more than 200 creatives on Google Ads, over a thousand in total, 94% of them app install ads, targeting over a hundred countries. At least one video ran continuously from Oct 24 to Nov 5 and led straight to this app (Google Ads Transparency Center, 11-06).
- Store search. The title is the generic term "Authenticator App - 2FA," the description is packed with platform names like Google, Microsoft, Facebook, Binance and Discord, and there are more than twenty screenshots. Users searching "authenticator," or even "google authenticator," can land on it. One iOS user wrote in Aug 19: "It's dressed up to look like Google Authenticator, so it shows up in results when you search that name."
- A SEO site with over 4 thousand pages. authenticator-2fa.com wrote a page for each of 4,211 sites on "how to turn on two-step verification for XX," plus 415 blog posts. The links carry SEO tracking parameters, and the homepage only has an App Store download button. Someone searches "how to set up mobile verification on Steam," reads the tutorial, and installs the app on the way.
- Channels not found: No trace of it on X, in media coverage, or among TikTok creators. Almost nobody outside discusses it. The only public criticism of this company is a GitHub post about their casting app, saying it's "full of ads and tries to get you to pay 40 dollars." That post is about a different product.
How the money comes back, and what it costs
Three things make the paid acquisition pay off. First, users arrive with a task: a website is forcing them to enable 2FA, and they just want to finish quickly, so they don't comparison shop. Second, the paywall is hard: the trial requires a payment method up front and auto-renews. Third, once an account is linked, people are afraid to delete the app, since they might lose access. An iOS user's one-star review from Oct 16 says exactly this: "I don't want to pay $9.99 a week, and now I can't log into any of my accounts."
The costs are in the reviews too. Going through the most "helpful" few dozen reviews in the US App Store, more than half are one-star, with highly consistent complaints: "Charged $9.99 right after the free trial started," "Still charging after I deleted the app," "Can't find where to cancel," "I'm 75 years old and live on social security." The Play review with 62 likes says "you have to pay, about 8 dollars or more," and the one with 25 likes says "there's no real free trial, and you can't cancel on the website" (Google Play, 8-25, 9-17). The five-star reviews include plenty of "Haven't used this yet but I am excited" praise from people who haven't even tried it.
In other words, its retention comes not from the product being good but from "being locked in so you don't dare leave" plus "not knowing how to cancel." This is exactly what Apple, Google, and the US FTC (with its new auto-renewal rules) are watching. When the window closes is not up to the people making the app.
Who it's competing with
| Product | Scale (Google Play, 11-06) | How it compares |
|---|---|---|
| Google Authenticator | 342M installs, +1.58M in a week | Free, no ads, cloud sync: the real demand bulk |
| Microsoft Authenticator | 246M installs | Free; the one it's most often mistaken for |
| Authenticator App - SafeAuth | 36.9M installs | The same paywall playbook three years earlier, 100 times bigger |
| Authenticator App (Starnest, Vietnam) | 24.7M installs | Another Vietnamese factory, earlier and bigger |
| Authenticator App - 2FA Auth (Universe, Turkey) | 2.78M installs | Turkish tool factory, same playbook |
| Authenticator - 2FA & MFA (SWAPP, Turkey) | 158k installs | Scaled up around the same time, also running Google Ads |
| 2FAS, Aegis, FreeOTP, Proton | 2FAS 6.06M, FreeOTP 5M | Free and open source, top pick in media reviews |
In this tier of 'paid Authenticator apps', there are at least ten factories from Vietnam and Turkey, and four or five of them were running Google Ads for this kind of app in the same week. This one is itself a late follower, and a small one among the followers.
If it were you
Bottom line: Don't copy it. Every usable angle in the '2FA' keyword has already been worked by the factories. The leader SafeAuth is 100 times bigger than this one. It got traction because of a 300M-install developer account, an existing paid acquisition team, and money it had already earned on iOS.
Who it fits: Teams already running a tool-app portfolio, with Google App Campaigns experience, a subscription funnel they can reuse, and older developer accounts. For them, this is just another category.
Who it doesn't fit: Solo indie devs, small teams with no paid acquisition budget, and anyone trying to build a genuinely good verifier that sells on word of mouth. The verifier users actually want is free, and the people who pay for this are mostly the ones who didn't realize what they installed.
If you want to take anything from it, take these three things:
- Tool categories where 'the website forces you to do it, the user is in a hurry, and the free option is hard to find' (captchas, scanning, screen mirroring, printing, VPN) naturally support a paywall. Finding a language or niche the factories haven't saturated beats building another English 2FA app.
- Validate the top-grossing position on iOS first, then port to Android cheaply with KMP. This sequence works for any tool category.
- Programmatic SEO: one page per service explaining 'how to enable feature X on Y', catching long-tail search. This costs no ad money, so small teams can afford it.
How to get users: To copy this, you need Google App Campaigns paid acquisition, plus store-search keywords, plus programmatic SEO. Doing only SEO or only store optimization won't beat the dozen-plus players already buying installs on this term.
When you're too late: There's no window left to catch. This slot is full. The real deadline is in the platforms' hands: if Apple, Google, or the FTC crack down on 'impersonating big brands' and 'subscriptions you can't cancel', this layer of apps will be cleared out first.
What would show this read is wrong: If installs hold up on Android after it stops buying, or if the share of iOS one-star reviews complaining about charges drops noticeably while its chart rank holds, that means the product and retention are better than they look, and the category has room for a 'fair paid version'.
Research notes: competitor table, acquisition evidence, full research report
- Competitors
Name Where Launched Scale How it differs from this one Google Authenticator Big-company features About 2012 342M installs Free, no ads, cloud sync; it charges a subscription Microsoft Authenticator Big-company features About 2015 246M installs Free, enterprise MFA push Authenticator App - SafeAuth Android About 2023 36.9M installs, +130k in 7 days Same paywall model, three years earlier and 100 times bigger Authenticator App(Starnest JSC) Android About 2023 24.7M installs Also a Vietnamese factory, earlier and bigger Authenticator App - 2FA Auth(Universe Digital) Android About 2025-06 2.78M installs, #10 Top Grossing in Australia's TOOLS Turkish factory, same playbook Authenticator - 2FA & MFA App(SWAPP) Android About 2026-06 158k installs Nearly the same time, 22 ads on Google Ads 2FAS / Aegis / FreeOTP / Proton Authenticator Open source 2014–2025 2FAS 6.06M, FreeOTP 5M, Proton 600K Free and open source, top pick in media reviews; it doesn't rely on word of mouth, it relies on paid acquisition and search Authy Other 2012 Not verified Free, multi-device sync - Where users come from
- Confirmed Google App Campaigns (UAC): googleads library, BEGAMOB GLOBAL LIMITED, mapping confidence high. In the last 7 days it ran 200 ads (capped), 1,033 in total, 94% of them app install ads. Video creatives link straight to this app (2026-10-24 to 11-05).
- Inferred Store search / ASO: generic title 'Authenticator App - 2FA', package name otp.password, and the description stuffed with dozens of platform names. Users are sent there by websites that require 2FA, then they search for it.
- Confirmed Programmatic SEO: authenticator-2fa.com has 4,211 service pages and 415 articles, with links tagged utm_campaign=SEO, mainly sending iOS traffic.
- Confirmed Port after iOS validation (KMP): the release notes read authenticator_kmp/production_v1.1.6. The iOS version launched 2025-11, before Android started to grow.
- Inferred Cross-promotion across the company's portfolio: the same developer account has 18 apps and 324M installs. No direct evidence of cross-promotion was found.
Why Authenticator App - 2FA (com.authenticator.otp.password) works
Developer: iKame Applications - Begamob Global (Begamob Global Limited, the Hong Kong entity of the Hanoi-based iKame group). Channel: Google Play, TOOLS. Research date: 2026-11-06.
Bottom line
This isn't a new product from a solo indie dev. It's the Vietnamese app factory iKame/Begamob porting its already-working iOS 2FA subscription app (App Store 'Authenticator ℠ App', launched 2025-11-19, #7 Top Grossing in the US Utilities chart) to Android with Kotlin Multiplatform. On Android it relies on the company's usual playbook: Google App Campaigns (UAC), ASO on the high-volume 'authenticator' keyword, and a programmatic SEO site with 4000 pages. Money comes from a 3-day free trial that auto-converts to a subscription, plus in-app purchases of $5.99–$49.99. The product itself has almost no differentiation. It worked because the company has a full set of distribution and monetization resources, and it picked a category with real user need, high search volume, and a hard paywall.
1. Data
- Installs (googleplay library, exact global cumulative numbers): 2026-10-29 was 340,021,11-06, 354,915,7 was 14,894, a daily gain of roughly 1.5–2 thousand. The store page shows the tier '100K+', rating 4.5 from 4,920 reviews (Play page, 2026-11-06).
- Curve since launch (googleplay.app_day_ext, AppstoreSpy estimate): 2026-05-20 already had 15,808 installs, but the data card's 'release date 2026-07-26' was reset (info or region changes), so the real launch was at least before May. June 30K to 60K, August passed 10 100K, September about 1 155K, October 4 250K, October about 26 339K. It accelerated from late August to mid October, with single-observation daily gains often at 5K–14K, then slowed to 1.5–2K per day after late October. The increase comes in steps, like a campaign turned on and off by budget, not like organic word of mouth.
- Charts (googleplay.chart_rank): #16–23 Top Grossing in the Philippines TOOLS category (from 10-29 to 10-31 it also charted #191–198 on the Philippines overall Top Grossing chart), #80–89 Top Grossing in US TOOLS, #47–50 in Australia, across 12 stores in total. No Top Free ranking. Several small stores share the same #118 rank, most likely from one aggregated chart, so don't treat those as real rankings.
- Payment model described in reviews (Play page reviews): 'You have to pay, around 8 dollars or more' (17,62 people found it useful in Sep); 'There's no real free trial... premium gets turned on automatically, you're charged after 3 days, and you can't cancel on the website' (25,25 people found it useful in Aug). So it's a hard paywall with a free trial that auto-converts to a subscription, and it also shows ads (the page is labeled Contains ads).
- iOS is the main channel (appstore library, 2026-11-06): the same-named app 'Authenticator ℠ App' (id6754900760, bundle com.begamob.authent), launched 2025-11-19. In the US store it has 6,576 ratings, gaining 7 ratings in 275 days; its best US Utilities Top Grossing rank was #7, #5 in the UK, #4 in Germany, #6 in Australia, #6 in the Netherlands. The Android release notes read 'authenticator_kmp/production_v1.1.6', showing both platforms share one Kotlin Multiplatform codebase. The Android version is the iOS winner brought over.
2. Competitors (googleplay library app_profile, 2026-11-06)
| Product | Where | Launched | Scale | How it differs |
|---|---|---|---|---|
| Google Authenticator | Big-company features / Android | About 2012 | 342M installs, +1.58M in 7 days | Free, no ads, Google account cloud sync; largest organic traffic |
| Microsoft Authenticator | Big-company features / Android | About 2015 | 246M installs | Free, enterprise MFA push |
| Authenticator App - SafeAuth | Android | About 2023 | 36.9M installs, +7K in 130 days, #19 Top Grossing in the Philippines TOOLS | A paywall tool app too, but three years earlier and 100 times the volume |
| Authenticator App (Starnest JSC, Vietnam) | Android | About 2023 | 24.7M installs, +206k in 7 days | The same Vietnamese factory playbook, earlier and bigger |
| Authenticator App - 2FA Auth (Universe Digital, Turkey) | Android/iOS | About 2025-06 | 2.78M installs, +7K in 93 days, #10 Top Grossing in Australia's TOOLS | A Turkish tool factory, also a paywall |
| Authenticator - 2FA & MFA App (SWAPP, Turkey) | Android | About 2026-06 | 158K installs, +7K in 20 days, #11 Top Grossing in Malaysia's TOOLS | Scaled up almost in step with it; 22 creatives running on Google Ads |
| Authenticator 2FA OTP Backup(Duong Van Luong) | Android | About 2023 | 3.07M, 7 days +90k | Personal-account portfolio |
| 2FAS, Aegis, FreeOTP, Proton Authenticator | Open source / Android | 2014–2025 | 2FAS 6.06M, FreeOTP 5M, Proton 600K | Free and open source, ranked first in media reviews (PCMag and Wirecutter recommend 2FAS, Aegis, Authy) |
| Authy(Twilio) | Android/iOS | 2012 | Not included in this query | Free, multi-device sync |
| Multiple "Authenticator App" listings from QUANTIX MEDIA, Galixo, and others | Android | 2026 | Small | running on Google Ads (googleads.adv_app) |
Verdict: this is a crowded category. Big-tech free options take most installs, and a whole layer of tool factories in Vietnam, Turkey, and the UAE are making "paid Authenticator" apps. In that layer it's a late entrant, and it's small (350k vs SafeAuth's 37M).
3. Growth tactics (evidence)
- Google app ad buying (confirmed): in the googleads library, advertiser "BEGAMOB GLOBAL LIMITED" (AR14881673759193825281) has mapping confidence high. In the last 7 days it ran 200 creatives (capped, actual count is higher), 1,033 in total. 94% are app install ads and 66% are video, targeting over a hundred countries. At least 1 video creatives point directly to this app (2026-10-24 to 11-05 running); the roster count attributes 4 creatives to it. Many UAC creatives don't expose a package name, so the real number is likely higher. No Meta ad library hits; TikTok (Europe) is unconfirmed.
- Store search / ASO (inferred, high confidence): the title is the generic "Authenticator App - 2FA", the package is otp.password, and the description stacks dozens of platform names like Google, Microsoft, Facebook, and Binance. It has 20 screenshots. It captures search traffic for "authenticator", a need-driven term. Users get told by websites to "enable 2FA, install an authenticator" and then search the store; which app they pick depends on ranking.
- Programmatic SEO site (confirmed, mainly serving iOS): authenticator-2fa.com (redirected from authenticator-app.begamob.com) has 4,211 service pages "how to enable 2FA for XX" (service sitemap, updated Oct 29), 415 blog posts with titles like "google-authenticator-app-android" and "steam-mobile-authenticator-download", and links tagged utm_campaign=SEO. The homepage claims "10M users" (unverified, likely marketing copy). The homepage only has an App Store download button, so SEO mainly sends iOS traffic.
- Company portfolio and cross-promotion (inferred): the same developer account has 18 apps in the library, totaling 324M installs (Cast for Chromecast 97.5M, Word Document 94.2M, AI Cleaner 11M, etc.). Cross-promotion between utility apps and AdMob house ads is common, but I found no direct evidence this time.
- Channels not found: X (x-radar, 90 posts for "begamob" in 0 days), press coverage, and TikTok creators turned up nothing. The only public discussion of iKame/Begamob is a GitHub gist criticizing their portfolio approach and aggressive ads in the Cast to TV category, which "try to trick you into paying 40 bucks". It doesn't mention this 2FA app.
4. Why it took off
- Where the money comes from: 2FA is a need-driven category (websites force it), so users who search for it install right away. They get a 3-day free trial, then auto-billing, with subscriptions at $5.99–$49.99 and in-app purchases. That's a hard paywall. Users also rarely uninstall because their accounts are tied to it, so churn is low. That makes each user worth enough to fund UAC. The US-store Utilities #7 result on iOS shows the unit economics work. On Android, they're copying the same funnel.
- Resource advantage: the Vietnamese factory has a ready ad team, creative pipeline, KMP codebase, and a developer account with 300M installs (its account weight and review history are already built). Moving a category validated on iOS to Android is cheap.
- Ramp pattern: slow testing from 5 through July, budget raised from late August to mid October (daily installs rising from about 1k to 5k–14k), then pulled back in late October. That matches budgets being adjusted by ROI.
- Do users stick?: the 4.5 rating likely includes some incentivized reviews (some review text is clearly templated praise), and users complain about surprise charges and cancellations that don't work. Retention comes from lock-in from 2FA, not from the product experience.
5. Differentiation
Functionally there's almost nothing new: TOTP, QR scanning, biometric lock, password storage, and an incognito built-in browser all exist in SafeAuth, Starnest, and 2FAS. The real difference is the business model. Big free players and open-source options don't charge. This app turns something free into a subscription, and makes money through paid acquisition and search capture aimed at ordinary users who don't know a free option exists and are in a hurry to "enable 2FA". The paywall plus paid acquisition is what makes it profitable, but it isn't the originator: SafeAuth and Starnest were doing this already. So the reason it's breaking through isn't the product. It's iKame's setup: iOS validation, Android replication, and UAC plus SEO distribution.
6. How many people have seen it
Revenue isn't public. There's no TrustMRR listing, and the founders haven't posted numbers. No media or X coverage of this app either. But the "paid Authenticator" category is already crowded: Vietnamese and Turkish factories alone run at least 10 similar apps, and in 7 days 4–5 advertisers ran authenticator-type apps on Google Ads. Visibility is low for this app specifically, but the category itself is not a blue ocean.
7. Takeaways
- Look for tools where websites force the need, users are in a hurry, and big companies offer it free but ordinary users don't know it. Think 2FA, scanning, screen mirroring, printing, VPN. Catch store search with generic-word titles and keyword stacking, then monetize with a free trial that auto-converts to subscription.
- Validate chart positions on iOS first, then port to Android cheaply with KMP to capture a second revenue stream.
- Programmatic SEO: build a "How to enable 2FA on X" page for every service that supports 2FA (over 4 thousand pages) to capture long-tail search.
- Risks to watch: surprise-charge complaints, regulation (the US FTC's rules on auto-renewal), and Google policy.
8. Uncertain
- Actual revenue and the Android/iOS revenue split (only inferable from chart rankings).
- How large the paid-acquisition budget is, and what ROI it's optimized to; how many UAC creatives actually belong to this app (the library can only confirm 1–4).
- The real launch date (it had 16k installs before May; the Jul 26 data point looks like a reset).
- Whether there's cross-promotion or review incentivization; there's no direct evidence either way.
- The "10M users" claim is unverified.
Sources
- googleplay library (app_profile, app_day, app_day_ext AppstoreSpy estimates, chart_rank, app, developer), 2026-10-29 to 11-06
- appstore library app_profile (id6754900760), 2026-11-06; iTunes lookup API
- googleads library (watch, advertiser, adv_app, creative), 2026-11-06; metaads / tiktokads mapping queries
- Play Store page: play.google.com/store/apps/details?id=com.authenticator.otp.…
- App Store:apps.apple.com/us/app/authenticator-app/id6754900760
- SEO site: authenticator-2fa.com/ (sitemap_index.xml)
- iKame/Begamob background: gist.github.com/stefanpledl/af971648074b4dae3b263227de16ffad; begamob.com/
- Media reviews (competitor context): PCMag 2026 best Authenticator, Wirecutter