In providing first 4 and last 4 number of credit card to vendor safe, considering you dont provide the expiration date or CVV2 number?
Per PCI-DSS Req. 3.3 You are allowed to display at most the first 6 and last 4.
This is typically not needed (most software just use the last 4).
I've seen a lot of app companies take the stance that they need the PAN digits to find transactions, however, this is usually because the of the poor implementation of the software and most of the industry has moved on to providing tokens.
It's not really a security thing other than to check that the full PAN is not stored anywhere.
Some states/cities have recipient requirements requiring "4 and 4" or "6 and 4", or only 4. E.G New York