Using any hash algorithm to "fuzz" the card is often reversible.
Since there are only a finite quantity of card numbers, remember the last digit maybe a check digit. Not all the entire card space needs to be checked. It is well known what the card issuer prefixes are so you perform your searches there. So now your 16 digit PAN, lost the last digit for check digit and the first 4 to 6 for card issuer. That is not a lot of combinations to brute force, maybe a single PC with a GPU can do it in a few hours.
So even salted data is useless when you can exhaustively search the entire keyspace with a few clicks and an AWS or evil botnet cluster and get the results back in an hour. Computers are fast enough to cycle through ALL combinations to find the hash that matches. The salt is usually known and designed to protect against pre-computation, but that doesn't matter if you can re-compute a complete new data set based on known salt quickly.
So what is important is the exact algorithm used in conjunction with a hash like MD5.
What is the point of using MD5 anyway ? If you need a token the represent a card number issue it from an independent keyspace. A sequential counter starting at 000000001 and encrypted with a completely secret key will always grant you a unique output value for the blocksize that is completely unrelated to the card data (and therefore not reversible) without the mapping database being compromised.
If you really need to fuzz the card number look towards PBKDF2 for all usage where you considered a hash. Since you can bring back the intention of the salt by making it too costly to brute force (even on GPU even on AWS cluster).
Ask your PCI compliance people if you substituted number 0 for A, 1 for B, ... 9 for J, etc... and stored it in the database if this is "strong" enough.
Straight use of MD5 to fuzz card number (even with known salt) can be broken at the rate of 450million/sec on a GPU (from my quick google). Remember we lost some PAN digits to brute, so we can do 10 digit in 2 seconds.
Sorry if not 100% on topic but use of MD5 to "strongly" secure credit card is a joke in 2013.