Bank CSV descriptions starting with =: import them as text

The desktop apps export date, description, and amount as CSV. Open CSV in Excel to save an XLSX workbook. Statement support varies: verify the result against your own PDF.

Identify the column and opening route

OWASP’s CSV Injection guidance describes formula-trigger risks including =, +, -, @ and certain control or fullwidth characters. It also warns that escaping can fail after Excel saves and reopens a CSV. There is no universal transformation guaranteed for every spreadsheet and later use.

Keep the original bytes, source identity and intended destination. A leading minus in a verified numeric amount and a formula-like description are different cases. Silently adding apostrophes to all fields changes the dataset and may break later amount parsing.

Select Text before finishing the import

Microsoft documents the Text Import Wizard for Excel desktop. For the documented desktop versions Microsoft 365, Excel 2024 and Excel 2021, where the command is enabled, start Data → Get & Transform Data → Get Data → Legacy Wizards → From Text (Legacy). This is the legacy wizard, not the Power Query editor.

Choose the real delimiter and quote character.
Inspect the preview and select the description column.
Set Column data format → Text before finishing.
Check the resulting working copy rather than assuming the opening route applied the intended type.

General and Text are different choices. Access to legacy import commands can depend on the installed version and enabled data-import settings.

The separate text/CSV import documentation explains available opening routes. Double-clicking a CSV is not evidence that the intended text setting was applied. Do not automatically refresh untrusted sources or activate content to bypass a warning.

What our harmless example actually demonstrates

date,description,amount
2026-02-03,"=1+1",-12.30

Python 3.13.7’s CSV reader returns the description as the string =1+1, with its leading equals intact. Writing and reading the CSV again preserves it; the negative amount remains a separate field. These executed controls show that structural CSV roundtripping is not sanitization. They do not execute Excel, prove its cell types or certify save/reopen behavior.

In the actual working workbook, review the stored description as text and the amount in the required numeric representation. Save a separate workbook, reopen that exact copy and inspect the relevant cells before relying on it. If you later export another CSV, assess its opening route again: CSV does not carry the workbook’s cell-type setting.

Keep each deliverable explicit

Retain the unchanged source, reviewed workbook and any recipient-specific output as separate revisions. If you cannot establish the cell type or recipient behavior, leave that copy unapproved rather than claiming universal protection. LocalExtract exports CSV, not a workbook with enforced text-cell types; converting locally does not remove this downstream review step.

Record what each file stage actually establishes

This guide is for the bookkeeper checking descriptions from a third-party bank CSV before spreadsheet review. Keep the description’s text type separate from the amount’s numeric representation and the CSV’s field boundaries.

Stage	What it can preserve or establish	What it does not establish
CSV quotation	Delimiter and embedded-text structure	A spreadsheet cell type
Documented Text import choice	The intended type for the selected description column	That an unchecked opening used that choice
Reviewed, saved workbook	A specific working copy to inspect again	A guarantee about later CSV exports
Another CSV export	A new text file with its own opening route	Persistence of workbook text-cell settings

For the harmless example, executed Python controls retain =1+1 after reading and after writing/reading again; -12.30 remains a separate amount string. The negative conclusion matters: a successful CSV roundtrip is not sanitization. No Excel execution or saved-cell inspection is implied. Keep the original source, reviewed workbook and recipient output as separate revisions, and leave a copy unapproved if the relevant type or later opening route cannot be established.

Download the manual review worksheet to record this task’s evidence and open questions. Its populated rows are fictional; the headings are our own working labels, not vendor fields or an import template. Replace teaching aliases only in your private working copy. An unobserved or NOT_TESTED state is not a completed check.

Synthetic review case. The values are teaching data, not a vendor export or an import file.

For a bank source available only as PDF, download LocalExtract. It processes one PDF locally into date,description,amount CSV; check the extracted rows against the issued statement before using them.

Documentation for the added task checked October 16, 2026.