Ninty will know who has done what. The worst they can do is ban them from using the shop, and perhaps in the future with a game forced firmware update to stop them playing online. Legally it is only a civil crime, because they have not done this for profit so there is zero chance of a criminal...