A capture of a live transaction contains the account number, usually more than once, in more places than you will find by eye. It is in tag 5A, in the Track 2 equivalent in tag 57, sometimes in a Track 1 record, in the issuer identification number in tag 42 — and it can be recovered from the ICC public key certificate, because that certificate contains the account number and the scheme's root keys are published. Redacting the obvious copy and keeping the certificate leaks exactly what you thought you had removed.
Capture your own cards, or cards you have written permission to test. That sounds like boilerplate and is not: the data is regulated in most jurisdictions regardless of intent, and "it was for research" is a description of your motive rather than a legal position. Test cards from the schemes exist precisely so that this question does not have to come up.
When you do sanitise, replace rather than delete. A capture with the account number cut out no longer parses, the lengths no longer match, and it stops being useful as a teaching artifact. Substituting a published test number of the same length and rebuilding the records around it keeps every structure intact — which is why the captures on this site can still be decoded byte for byte.