You're using substr repetitively, but you don't need to.

print obscure('5555666677778888', 4, 2, '*');

sub obscure {
   my ($num, $tip, $tail, $char) = @_;
   my $repl_length = length($num) - $tip - $tail;

   substr($num, $tip, $repl_length) = $char x $repl_length;
   
   return $num;
}

__END__
5555**********88
[download]

Looking at this again, I'm noting that this in production code should really make use of some data validation. Calling obscure() with a negative value for $tip would have some interesting results, for example. ;-)

Updates:

• 2006-08-25 : Added thoughts about data validation