The banks (BnP, CdE) I use ask you to confirm in their apps, and have never seen this before! Not to say this isn't legit -- I can completely imagine this happening.

That said, I absolutely also hate having only a choice of a 6 digit pin on a UI that's intentionally designed to disallow any password manager usage. Plus they shuffle the inputs, make you change pin every n-usage/n-days. I really don't get the rationale other than it maybe avoids screen scraping, or keylogging?