I think sneaking into first class (for purposes of sitting there, rather than using the bathroom) has been successfully prosecuted as theft-of-services. Most people wouldn't go for that.

Using codes, IMO, is murkier. Many people would say that if the computer takes it, it's fair game. Should it be an individual responsibility to see if they're qualified, or a provider responsibility to police it through automated means (as more and more are doing)? It's kind of like crashing a party you weren't invited to (but of course SHOULD HAVE been).