For a password field, "autocomplete" doesn't mean to suggest candidate completions, but rather to prefill with the password part of a previously saved username-password pair, and to offer to save such a pair (or update an existing one with a newly entered and different password) when the form is submitted. Giving the field an "autocomplete" attribute with the value "off" disables this behavior, which matters for PCI compliance because it forestalls browsers from storing the password when they might do so insecurely.