Account numbers
I think the masking features are brilliant, but they do not go far enough. There should be a masking feature included for the account and routing numbers for payment and refund. The SSN is not the only identifying number that could cause a significant breach in client security.
