A retail company's customer support portal displays order confirmations that include full credit card numbers to support agents. The security team wants agents to see only the last four digits (e.g., ************1234) while keeping the transformation irreversible and requiring no key management. The masking must be applied consistently as the confirmation text is rendered. Which Sensitive Data Protection (DLP) de-identification transformation should you configure?