In The Netherlands, one can access government services using a login platform called DigID. Some services require a two factor authentication, for which one can use a mobile app.
This requires the following steps
- Enter on the website the four-letter 'coupling code' displayed on the app (changes at each use)
- Scan QR code displayed on the website using the app
- Confirm login and enter five-digit pin code (known only to the user) on the app
The first step is a recent addition to this process, but I can't figure out what purpose it serves. What possible security threat is mitigated with this first step?