This is a normal two factor authentication (2FA).
They are requiring two things:
- Something you know, in the form of a password (what you refer above as a PIN, but they don't seem to require that it is a number, so it's just a normal password)
- Something you have, which you prove by providing the OTP (one-time password) generated by an app (it could also be provided by a hardware token, for instance).
- The assumption for this is that if you are able to provide the correct OTP, you have the phone or hardware token with you (this isn't strictly true in that it would be possible to extract the secret from a completely compromised phone, or you could have configured multiple phones with the same seed, but it's generally considered a good enough compromise)
Then, you obviously need to provide the three pieces in order to log in:
- Username (which is the full email address in this case)
- Password
- OTP
The only odd part here is that the OTP is provided in the same field as the password. This is generally used so that existing systems asking just username and password can easily work with an additional OTP. Only the authentication system need to be updated in order to support 2FA, as the rest of the systems would simply consider it part of the password.
This is not less secure than using a separate field. Let's consider that the OTP codes have a length of six digits, which are the most common ones. The authentication server would check if the user has OTP enabled and, if so, take the last 6 characters from the password field and check if they match with the expected OTP, while they validate the rest of the provided password for the actual password.
However, as noted by Royce Williams, while more simple architecturally, it leads to a more confusing user interface.