Looking around at other financial services providers, asking for 2 PIN digits only once other security information has been entered is a fairly common pattern. Are there any significant benefits from this approach compared to asking for all the information on a single screen?
I'm assuming that the other systems you've looked at only tell you whether any of your details are incorrect after the second step, and do not disclose which part of the credentials were incorrect, which is good.
Yes there are significant benefits, because then the index of the digits are only asked for when it is determined which username it is that is attempting to authenticate.
Say an attacker had somehow got some partial details of an account (e.g. by shoulder surfing). Let's say they know the 2nd and 3rd digits of the PIN.
If the page asked for all the details on one page (username, password and two digits from the PIN), the attacker could simply refresh the page, clearing cookies each time, until the PIN prompt was for the 2nd and 3rd digits of the PIN.
Using the two step approach, the digits asked for can be remembered by the system. e.g.
for username "foo" we asked for the 1st and 4th numbers - we will not ask for any others until these have been entered correctly. The system would also have to remember the digits asked for for invalid usernames to prevent a username enumeration attack where different usernames can be tried twice to see if the same digits are requested. You might also want to artificially refresh these digits after a set number of days to simulate a successful login (otherwise an attacker would know that the account is invalid or dormant if it always asked for the same two digits on attempts days apart).
The other approach would be to ask for all the digits of the PIN on the same page, but banks don't like doing this because of shoulder surfing and also phishing sites can easily mimic these pages and capture all information in one go (although I'm not saying that the stepped approach would necessarily prevent these sort of attacks).