I don't have Incident Thread Masking System Masks enabled but yet numbers in that format are still being masked, why is this happening? 

Environment:

Configuration/Service/Incident Thread Masking
Oracle B2C Service, All supported versions

Issue:

We have disabled all Incident Thread Masking System Masks yet numbers in that format are still being masked.

Resolution:

You must Save and Deploy after any changes have been made in the Incident Thread Masking tool.

When the Incident Thread Masking feature has been enabled on a site, masking for credit cards, SSN, and phone numbers are automatically enabled.

If you disable one or more of these masks you must save and deploy in order for these changes to take effect. However if you just make the change and save without deploying it will appear as if the change is in effect. If you use the Preview Text option and input let's say a SSN number the Result Text show that the SSN number is not masked. But keep in mind, this is just a preview of what it will be, assuming that you have Saved and Deployed.

Click to enlarge image

However if you only saved and did not deploy and then attempt to send a response or create a private message in an incident with a SSN number in it, you will find that it will still be masked.

See Answer ID 6657: Popular answers about Incident Thread Masking for more information.