Ok.
as a workaround i also added such as pattern:

@Pattern(regexp = "[\\d\\s ]*")
@CreditCardNumber
public String cardNumber;

without the dashes.

note: better to set * instead of +, so as to accept a null credit card number (as it is the case today).
if the developer wants to force a non null card number, then he can add @NotNull constraint.