Just learned that in Australia you can only put a ban on your credit for 21 days, and to extend it you need to prove you've been, or are likely to be, a victim of identity fraud.
This seems really dodgy to me. There is no reason that people should be able to access your credit info without your approval. They should need to ask every time. It should always be locked.