Best practice is to use a different means for sending the shard file and password, eg. email the file and call to tell them their password, or physically hand them a USB with their shards and tell them their password in person.