In reply to Jeffrey.

There is no way for a browser to know which fields are password and which are credit card, and obviously with JS you can create dynamic form after the page was loaded and therefor evade the notice at all.