Fake hotel WhatsApp phishing near-miss

Hello! I’m in England. Last week, I booked a two night stay in London via the AMEX travel platform. The stay is for March 23-25, and I paid in full (£150). Last night, I received a WhatsApp from a business account. It used my correct name, booking details, and so on. It asked me to confirm my booking by clicking on a link and paying £0 on my card. It said if I didn’t do this, my booking would be cancelled! I clicked on the link. It wouldn’t take my AMEX, so I tried with my Monzo. It then tried to take 400 Euros from my account, which I didn’t allow (it asked me to authorize). To be clear, I didn’t pay in Euros originally and the hotel is in the UK. This morning, I got another WhatsApp, this time from the hotel, asking if I had any questions. I mentioned what had happened. They responded a few minutes later saying that this was a phishing scam and not to click on the link! I am furious! Clearly, either AMEX or the hotel had leaked my details to scammers? How can I find out which it is? Also, who should I report this to? Thanks.