The maintenance register that will not add up - and an email asking for an OTP
The multi-skill assistant keeps the pump-house maintenance register in a spreadsheet on the shared office PC, which four people use with a single login. The file shows a total service cost of ₹4,300 across twelve entries, but the handwritten diary adds up to ₹6,500. The total cell contains =SUM(F2:F10) while entries run to row 14; some amounts in column F were typed with a trailing space or stored as text, and three cells display "###". Separately, an email from "[email protected]" with the subject "Updated register - enable macros" carries an attachment "Register_update.xlsm" and asks the assistant to open it and reply with the OTP sent to the secretary's phone "to verify the account". An unlabelled pen drive marked "ACCOUNTS BACKUP" is lying on the desk. The society's accountant is on leave and will check the register only next month.
1. Explain why the total shows ₹4,300 instead of ₹6,500, and give a safe, verifiable method of correcting and checking it.
Read the worked answer
Three separate causes, not one
- Short range: =SUM(F2:F10) covers rows 2-10 only, so the entries in rows 11-14 are simply not added. This alone explains a large part of the missing ₹2,200.
- Text-stored numbers: amounts typed with a trailing space or as text are ignored by SUM. Tell-tale signs are left-aligned values in a column of right-aligned ones and the small green error triangle. A trailing space can be removed with TRIM, or the text converted with VALUE / Text-to-Columns.
- "###" is not an error in the data - the column is too narrow. Widen it before judging anything.
Safe method
- Work on a copy: Save As with today's date first, so the original is preserved on a shared login.
- Add a helper column with =IFERROR(VALUE(TRIM(F2)),0) for every row, sum the helper column, and compare row by row with the handwritten diary and vouchers.
- Investigate each difference against the bill or receipt; never simply type 6500 into the total to make it agree - that turns a data problem into a false record.
- Because four people share one login, also check the file's modified date and, if it is on OneDrive/SharePoint, the version history to see who edited what.
2. How do you handle the email with the .xlsm attachment and the OTP request, and what do you do with the unlabelled pen drive?
Read the worked answer
The email has every phishing marker
- Sender is a free Gmail address, not the society's or accountant's official domain.
- The subject uses urgency ("Updated register") and the file is .xlsm - macro-enabled, so opening it and clicking 'Enable Content' runs code that can install malware or ransomware.
- It asks for an OTP, which is a one-time secret. No genuine bank, portal or accountant ever asks for one.
Actions, in order
- Do not open the attachment, do not enable macros, do not reply.
- Do not forward or share the OTP; tell the secretary the code has been requested by an outside party so the account can be watched and the password changed if anything was entered.
- Verify by a separate channel - phone the accountant on a known number, never a number given in the email.
- Report it to the office in-charge, mark it as phishing/spam, and delete it.
- If credentials were entered or money moved, report at cybercrime.gov.in or helpline 1930 quickly - the first 24 hours matter.
The pen drive Do not plug an unknown device into the office PC: it may carry malware through autorun, or it may be someone's lost data. Hand it unopened to the office/security, log where and when it was found, and let them decide. If it ever must be read, scan it on an isolated machine with autorun disabled - never on the PC that holds the accounts and register.
3. Set out a simple routine that would stop this register from going wrong again, covering backup, access, data entry and privacy.
Read the worked answer
Files and backup
- Keep one master file in a named folder with dated versions (Register_2025-06-01.xlsx); never overwrite the only copy.
- Save as .xlsx, not .xlsm; macros kept disabled.
- Follow 3-2-1: three copies, on two media, one off-site or cloud, plus a monthly PDF or printout filed in the office so a lost file does not wipe the AMC history.
Access
- Four people on one login means anyone can change anything. Ask for separate logins, or at least keep the master in a protected folder and give others a copy or a data-entry form.
- Protect the master sheet and keep a change log: date, entry, initials.
Data entry
- Amount columns formatted as numbers, with data validation (numbers only, no text, no trailing spaces).
- Use a fixed table that expands automatically and a check cell that compares the spreadsheet total with the diary total every month.
- Reconcile monthly against vouchers and get the accountant's sign-off instead of discovering the gap a month later.
Privacy and conduct Do not store residents' phone numbers, bank details or OTPs in the maintenance register; lock the PC when leaving the desk; and treat any request to share codes as a security incident, not an errand.