Will the string always be in the same format? - If so you can use a regular expression:
PHP Code:
$string '1234123456abcd';

$search "/^([0-9]{4})([0-9]{6})([a-z]{4})$/i";
$replace '\1-\2-\3';

$string preg_replace($search$replace$string);