A financial services company is building a test environment that mirrors production. Developers need realistic customer records to test an application, but the company must ensure that actual credit card numbers are never exposed in non-production systems while keeping the same data format so validation logic still functions. Which method best meets these requirements?