If I have to send it this way, any out-of-band communication is generally fine with me although I do prefer phone (out-of-band verification and no transmission over net).

Assuming your no side-channel requirement means no phone call available, I'd probably send with PGP. If its a pushy vendor, I'll be pushy back (company/position allows me to be pushy, ymmv). Worst case would be resorting to something like: "Password is the invoice number from XX/YY date and the first item code on the invoice" or something sufficently complex.