I feel like I should make a Shadow joke here, but basically I get tired of seeing this in individual queries.

gistfile1.sql

SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO

CREATE FUNCTION dbo.sensitiveDataMask
(
	@sTarget	varchar( 16 )
	
)
RETURNS varchar( 16 )
AS
BEGIN
	DECLARE	
		@sReturn				varchar( 16 ) ,
		@iTargetLength			integer ,
		@iStartPosition			integer ,
		@iAvailableCharacters	integer
		
	SELECT
		@sReturn=				'XXXXXXXXXXXX' ,
		@iTargetLength=			LEN( @sTarget ) ,
		@iStartPosition=		LEN( @sTarget ) - 4 + 1 ,
		@iAvailableCharacters=	4
		
	
	WHILE	@iStartPosition < 1 
		AND	@iAvailableCharacters > 0
	BEGIN
		SELECT	
			@sReturn=				@sReturn + 'X' ,
			@iStartPosition=		@iStartPosition + 1 ,
			@iAvailableCharacters=	@iAvailableCharacters - 1
	
	END
		
	SELECT
		@sReturn=	@sReturn + SUBSTRING( @sTarget , @iStartPosition , @iAvailableCharacters )

	RETURN	@sReturn
END
GO