I think it is necessary for some fields to have autocomplete="off" for PCI compliance (login/password field if I remember correctly).
So this creates the interesting situation where I should set autocomplete to something else so that chrome doesn't complete it, but that would result in a failed compliance check.
Yes. PCI is a silly substitute for actual security. But the alternative is that many banks and their partners will run with no security because bank executives as a class are firmly opposed to sharing authority with competent IT security people.
