You can use the functions substring, string-length and translate to achieve that:
Code:
<xsl:variable name="s" select="'123456789213'"/>
<xsl:value-of select="concat(translate(substring($s, 1, string-length($s) - 4), '0123456789', '**********'), substring($s, string-length($s) - 3))"/>