S.B. ...
I'm not sure what you're seeing, but it doesn't sound like it's coming from WikiTree. Even being logged in with my admin (sysop) account, I am unable to see anything resembling the last 4 digits of a credit card number.
If you'd like to send me the URL where you're seeing this, I might be able to shed some light ??? (maybe?) Feel free to send me a private message if you don't want to post it here.
Regarding the private profiles on your tree, I believe the answers below have covered that. You can also use the "Profile (public view)" tab on any of those profiles to see what the general public sees (i.e., people who are not on the Trusted List).