Couldn't phishers just start having their fake forms send the current form content via ajax every time a new character is typed, rather than only on submit?