Report the message as phishing.

The sender's address @helsinki.fi means the message is genuine, so I open the link.

Delete the message.

This is an attempt to trick you because you know this person by name.

The message is genuine because it has come through a junk mail filter.

The message is genuine, the sender's address contains the name of a person you know remotely.

The observer should verify the accuracy of the observation through large-scale testing before reporting it further.

It is the responsibility of the author of the observation - any member of the university staff or students - to notify the IT Helpdesk.

An individual student should not make observations about information security, as it is not a part of their responsibilities.