function private_str($str, $start, $end){
   $after = mb_substr($str, 0, $start, 'utf8');
   $repeat = str_repeat('*', $end);
   $before = mb_substr($str, ($start + $end), strlen($str), 'utf8');
   return $after.$repeat.$before;
}

<td>{{  private_str($pay->user->email,0,3)   }}</td>