Trimming email address to hide the name
Guard clauses are easier to read than nested blocks.

It will be somewhat more efficient to track the index of the @ sign rather than using substrings. You definitely don’t need Apache commons.

Try not to reassign variables if you can help it. In this case, you can leverage a StringBuilder to mutate your email address into a new String. The replace method is particularly applicable.

Using the above ideas, you could change your code to look more like:

private static String getEmail(final String param){
    final Map&lt;String, String&gt; emails = new HashMap&lt;&gt;();
    emails.put("sample1", "someone@gmail.com");
    emails.put("short", "qw@gmail.com");
    emails.put("noname", "@gmail.com");

    final String emailAddress = emails.get(param);
    if (emailAddress == null) {
        return null;
    }

    final int atIndex = emailAddress.indexOf('@');
    if (atIndex == 0) {
        return null;
    }

    final StringBuilder maskedEmailAddress = new StringBuilder(emailAddress);
    if (atIndex &lt; 4) {
        maskedEmailAddress.replace(1, atIndex, "**");
    } else {
        maskedEmailAddress.replace(4, atIndex, "**");
    }

    return maskedEmailAddress.toString();
}