I agree -- this is an obnoxious "feature" that X-Cart engineering put in -- probably the same engineer who decided to put the xcart favicon into every install.
You CAN work around this... use the smarty replace function, like this:
file:
<skin>/mail/html/order_invoice.tpl
FIND:
Code:
{$order.payment_method}
REPLACE WITH:
Code:
{$order.payment_method|replace:"(X-Payments: Credit Card)":"Credit Card"}
(and
Credit Card is whatever text you want to replace)
WHAT IT REALLY SHOULD BE:
Code:
{$order.payment_method|replace:"(X-Payments: Credit Card)":"$CreditCardType $last4digits"}
But X-Payments is unwilling to send the last 4 and card type back to xcart unencrypted. PCI regs permit it.

I've been bitching about this forever.
Maybe if enough people make the case, they won't think it's just "Jeremy's complaining..."