I've been thinking about this one, and I'm really stumped with what you could actually "be" charged with. Since you're "brute forcing" the password (IE: they're too dumb to change it), you could be technically be charged with unlawful entry (IE: trespassing), but that seems pretty lame, and unless you're being keylogged, it would be difficult to prove. If you're doing this repeatedly, you could be guilty of harassment, but with a business, they'd have to show proof of adverse effects. If you did get caught, the chain could go after you in civil court if your pranks caused any "damages" (loss of business, etc), but as you said, it would be a bitch to prove and probably too expensive to investigate.
Sounds to me like all systems are a go.