We use Stripe as our Payment Gateway/Processor and offload all credit card processing to them.
But when I want to update my card I can see you "know" the last 4 digits?
We pull this from Stripe when we load your card details for you.
When you enter your card details, we pass that directly to Stripe (it never goes to our servers) and they verify everything. We then receive a unique "token" from them for you which we use to charge your card through Stripe.