They're typically stored as "tokenized" values. The tokenized version shares the type and the last 4 digits (so that you can share it with the customer to help them identify the card). You buy this capability from vendors and IIRC there's like 3 or 4 common vendors in the marketplace.