maybe grabbing the last 4 digits of the CC before it gets storedin the db would be enough ... not sure where this happens in the code

.
It'd be a pretty simple snipet of code to grab the last for digits and store them in a table. Then whenever you needed to print or display the invoice you could grab that outta the DB.
just a thought:
Code:
//this would be the variable from the form
$cc_number = "1111222233334444";
//this creates the masked number
$masked_cc_number = "xxxx-xxxx-xxxx-".$cc_number[12].$cc_number[13].$cc_number[14].$cc_number[15];
Now you have a variable $masked_cc_number that could be stored in the db somewhere that is related to this order.
I haven't figured out what table holds the invoice data or how x-cart stores its data into the db yet but this should work.
any thoughts on where i might find the code that grabs the credit card number, and where it the code is that stores it in the db?
Thanks