* One time password fields.
* Admin pages for dealing with users
* CC virtual terminals
* Any time that the data being collected is about a third party.
The original motivation for autocomplete=off came back when Mozilla had a small market share and Firefox and Chrome didn't exist. Some major bank websites blocked Mozilla by User-Agent. When Mozilla and Mozilla users got in contact with those banks, the banks demanded the ability to block autocomplete for their login forms. Several times afterward, when people wanted to fix autocomplete, the banks had an effective veto with "we'll block you". At the time, Mozilla didn't have nearly enough market share to say "no, that's our users' decision".
