Financial websites (banks, credit reporting agencies, etc.) often use two stages when authenticating you:
- Identifier (account number, email, etc.)
- Two characters from a memorable word
I've noticed that if I fail to authenticate properly (wrong characters, website error) these websites request the exact same combination of characters from your memorable word.
The fact that this policy appears to be widespread hints that this has some security benefit.
What would such benefits to security be (as I can't think of any)?