I'm afraid they are finally getting around to checking their id logs for online play against purchase lists.
If you play online with something you have not purchased, they CAN detect it.
i've known how it could be done in theory for quite a while. everytime you play online with a cart, the cart's id is sent to nintendo.
every time you play online with a cia, your console id is sent to nintendo.
they can trivially log this info, and check it. before they were only checking simultaneous login from same cart id. this is how they were catching .3ds users.
If it turns out they ARE logging, and not just checking for simultaneous login, we simply have to accept that you must use nothing but legit cias (that are bundled with systems) or risk a ban wave.
Assuming they are detecting freeshopping and downloaded CIAs of their software, they are within their rights to ban.