Mask whole field value:

Mask all but last three characters:

(.+)…

Leave unmasked first four characters:

….(.+)

Pattern that hides five first characters then leave unmasked three, then hides rest of value except last four characters:

(.{5})…(.+)….

If the specified pattern does not matched field value, then the whole value is masked. For example string "ABS" doesn't match pattern

(.+)…

because it expects at least four characters (one at the beginning to be masked and three at the end to be left unmasked). In this case "ABS" is replaced with

"***"

.