Without knowing country specifics, I do not see a difference, why credit card numbers are secret and IBAN - not. Knowing any of them (ok, in case of IBAN, you also need a name), one could make payments, order goods over Internet in some countries (e.g., in Germany to order from Amazon only IBAN and name are needed). Please see Can someone steal money from my bank account if they know my IBAN and personal details?.
So, I would recommend to protect both account number and BIC parts of IBAN, since if you only mask out too few digits of bank account, using IBAN checksum and knowing typical account numbers (e.g., there are banks where last 2 account number digits are always 00) for specific bank (identified with BIC), someone could bruteforce an account number.
Lets take German IBAN as an example. It always looks like
DEcc bbbb bbbb aaaa aaaa aa
DE - country code, cc - checksum, b - BIC part, a - account number part.
Let's say you mask it out as:
DEcc bbbb bbbb XXXX aaaa XX
In my eyes it is not good at all, because now I know the checksum and BIC. From the BIC, I could know that the bank (1) has not so many accounts and (2) last 2 digits are reserved for other account types, e.g. 00 for main account, 01 could be partner account, 02 could be long-term deposit and so on. So, last 2 digits are always 00 for this bank and operating/settlement account.
Now we have 4 digits left. But from (1) I conclude that the bank has less than 1,000,000 clients. Than accounts of this bank will always look like
00aa aaaa 00
So now I only need to guess first two 'a'-s. But I have a checksum, which makes it very easy. If bank has more than million clients, it still could have a system, where first digit identifies country region, where an account was opened and so on.