2. In the front end(s) which use this service to display the payment details are changed where necessary
3. Somewhere else?
In the context of a billing process, another task service could expose the unmasked number so that particular service support the actual act of making payment with the card number.
The end result is that:
Note that the two task services could be replaced by one task service that could perform masking of card holder data, based upon additional parameters, ie. a reason code, which represents the context in which the service is called. The task service would then decide, based upon the reason code, whether or not to mask any data.