Everyone that's saying "just change your password after" is mistaken about how the authorization process works. Not only does WU never get your password, it wouldn't matter if you did change it. WU receives a cryptographic token that essentially lets them access your account without the password and changing the password doesn't revoke the token. The token itself can have a limited number of uses (in this case it's very likely a single-use token), but that's established at the time of creation and WU could easily request a multiple-use token and you'd never find out.
It's all moot, of course, because WU isn't looking to steal your funds (Wells Fargo, maybe), but of course it doesn't mean the implementation of the token system can't have a flaw and be abused by internal or external bad actors.
Edit: the point is, stop worrying about it, there's nothing you can do and most likely everything will be fine (except when it isn't).
It's all moot, of course, because WU isn't looking to steal your funds (Wells Fargo, maybe), but of course it doesn't mean the implementation of the token system can't have a flaw and be abused by internal or external bad actors.
Edit: the point is, stop worrying about it, there's nothing you can do and most likely everything will be fine (except when it isn't).