How a page can make hidden fields look ordinary
Browsers don’t decide what to fill solely by looking at what’s visible on the screen. They also inspect a form’s structure: field labels, names, and hints such as whether a box is for an address, email, or phone number. If a deceptive page adds fields that resemble familiar form inputs but places them offscreen or otherwise out of view, a browser may still recognize them as autofill targets.
The browser can then insert saved information into those boxes just as it would into a visible form. A field may be hidden from the person using the page without being inaccessible to the page’s own code.
Where the information can go
Once a field is filled, the site may be able to read its value. If the form is submitted, the information can be sent along with the visible fields; a page’s scripts may also be able to access it. That creates a gap between what a person can inspect and what the browser has populated.
Browsers use different checks to limit unwanted autofill, and not every invisible field will be filled. But a familiar autofill prompt is not proof that every field receiving data is on screen. Before accepting a suggestion, check the site’s address and look over the form—and avoid submitting information you did not mean to provide.
