Safest thing to do is not add the SM# until after the surprise. This will keep it out of email, app views, website, etc.
Only downside is if the person being surprised had a higher status level and adding their SM# would drive C+ upgrades or something.