Essay mills are commercial enterprises delivering assessable work on a fee-for-service basis. File-swapping sites encourage students to upload graded work and institutional materials to exchange for work or solutions submitted by others. The number of both types of sites continues to grow, indicating the issue is unlikely to disappear. Plagiarism preventative measures such as promoting academic integrity practices, and including recent real-world events in assessment design do not provide a disincentive to stop students purchasing or repurposing assignments due to the seemingly low risk of detection. This paper summarises the results of a content analysis study of detailed interview notes complied while investigating students with irregularities in their assignment submissions. A pattern of clues were identified within the irregularities. Clues indicating essay mill purchases included the misrepresentation of bibliographic material where information was omitted or changed, inappropriate references out of the subject area, the style and types of references used, in addition to generalised discussion that did not answer a specific question. File swapping site usage was identified through the inclusion of inappropriate and irrelevant material, bibliographic 'mashups' where academic journal and book information was blended into a single reference, and cross matching identified by Turnitin where students relied on the same file swapping source. Once the clues were identified patterns of use in other assignment work was easier to detect. Part of the key to detection is awareness, and knowing the patterns and signs evident in non-original work can assist in identifying other submissions warranting closer inspection.