Packet retransmission is a fundamental TCP mechanism that ensures reliable data transfer between two end nodes. Interestingly, when it comes to cellular data accounting, TCP retransmissions create an important policy issue giving rise to a tension between ISPs accounting for network resource consumption, and users only being aware of the application layer data. Regardless of the policies, we find that TCP retransmissions can be easily abused to manipulate the current practice of cellular traffic accounting. In this work, we investigate the TCP retransmission accounting policies of 12 cellular ISPs in 6 countries and report the accounting vulnerabilities with TCP retransmission attacks. First, we find that cellular data accounting policies vary between ISPs. While the majority of cellular ISPs blindly account for every IP packet, some ISPs intentionally remove the retransmission packets from the user bill for fairness. Second, we show that it is easy to launch the "usage-inflation" attack on the ISPs that blindly account for every IP packet. In our experiments, we could inflate the usage up to the monthly limit with an attack invisible to the subscriber and lasting only 9 minutes. For those ISPs that do not account for retransmission, we successfully launch the "free-riding" attack by tunneling the payload over fake TCP headers that look like retransmissions. To counter the attacks, we implement and evaluate Abacus, a lightweight , scalable accounting system that reliably detects "free-riding" attacks even in the 10 Gbps links. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.