I always wondered about this. Also, wouldn't it be really easy to have a form pull autofilled CC info via ajax without even needing the user to hit submit?
If all web developers set autocomplete="off" on their CC forms this wouldn't be an issue. But if it were up to me, browsers would refuse to remember numbers that "look like" credit cards and match the checksum. Does autocomplete even trigger on HTTPS forms? Maybe this isn't even that big an issue in the wild.
I was just wondering the same thing, using the onchange action.
If I'm remembering correctly, Chrome's autofill doesn't fire change events for the fields. Has annoyed me from a developer standpoint at times, but the reason behind it is valid.
Though to grab this info with ajax it doesn't have to fire off an event when the auto-complete changes it. It could just check every second itself if the form changed and if so send off the info.