You are right that the loan numbers are nonpublic personal information. The real question is whether this type of sharing falls within the privacy exceptions.
Attached is a link to an interpretive letter from the regulators concerning sharing loan numbers for a slightly different purpose, on recorded documents. It indicates that "there is an exception for disclosures that are "necessary to effect, administer, or enforce a transaction" that applies to, among other things, a disclosure that is "required, or is a usual, appropriate, or acceptable method to carry out the transaction or the product or service business of which the transaction is a part, and record or service or maintain the consumer's account in the ordinary course of providing the financial service or financial product...."
Interpretive letter 917