I also wanted to change the numbers provided in the confirmation email, but I didn't want to delete the entire command. If you take the first portion of the code mentioned in the previous post:
if (is_object($GLOBALS[$_SESSION['payment']])) {
$cc_num_display = (isset($this->info['cc_number']) && $this->info['cc_number'] != '') ? substr($this->info['cc_number'], 0, 4) . str_repeat('X', (strlen($this->info['cc_number']) - 8)) . substr($this->info['cc_number'], -4) . "\n\n" : '';
And replace it with this:
if (is_object($GLOBALS[$_SESSION['payment']])) {
$cc_num_display = (isset($this->info['cc_number']) && $this->info['cc_number'] != '') ? str_repeat('X', (strlen($this->info['cc_number']) - 4)) . substr($this->info['cc_number'], -4) . "\n\n" : '';
You'll end up with the following in your confirmation email:
XXXXXXXXXXXX1111
You can find the code in includes > classes > order.php. The code in question is near the end. Use the admin tool box to find the appropriate lines. I tested this out several times using 1.3.8a, and it's worked well so far. I prefer this method since you at least get the last four digits, but you hide the first four.