The problem turned out to be the report's expression. I should have guessed right away instead of wasting so much time. The report was masking the card number itself and it always used 12* + last 4 digits without checking if the initial expression was empty or not.