Santander's banking website uses both in some places, e.g. confirming a new payment. "Enter your 5-digit PIN and the 6-digit 2FA code we've just sent you", with

Santander's banking website uses both in some places, e.g. confirming a new payment. "Enter your 5-digit PIN and the 6-digit 2FA code we've just sent you", with 5 little input fields for the former, and a single standard input field for the latter. Perhaps a deliberate decision to make them look different, but it just looks like they couldn't make up their mind.