From what I’ve heard, the way they catch people is by the user agent, which is pretty easy to spoof.
It’ll be a cold day in hell before I pay AT&T $45 a month so I can tether once in a blue moon when I need to use a full screen to do something on the road.
I gather they're also analyzing graphic sizes being requested by the browsers as an indicator. If there is a disparity between the device on contract and it's ability to display the browser requested graphic, that's a strong indicator of tethering.