Default Passwords Led to $55 Million in Bogus Phone Charges