What is the difference between masking and truncation? - Axenic
How can you make stored PAN information unreadable? - PCI DSS GUIDE
pci dss - I have recovered my credit card PAN (6 chars masked) and expiration date on a merchant site, acceptable or not? - Information Security Stack Exchange