So even after masking starting 4 n ending 4, after giving the statement they will get to know the last 4 digits. And by knowing the card they may also knowing the first 4, hence in the end they'll be knowing everything including expiry date except cvv.
Best is to turn off txns and replace as
@SamPtnk told