Inside a complex syntax brackets ( {$var} ) you can call any function with a return value that can be converted to casted to a string. So using your code that would be:
$message .= "<td>XXXX-XXXX-XXXX-{substr($_GET['cc_number'] , -4, 4)}</td>";
//Or this....
$message .= "<td>XXXX-XXXX-XXXX-".substr($_GET['cc_number'] , -4, 4)."</td>";
//Or even this...
$message .= "<td>XXXX-XXXX-XXXX-";
$message .= substr($_GET['cc_number'] , -4, 4);
$message .= "</td>";
The first or second ones make most sense to me, so I would chose one of them, but it's totally up to you!