CreditCardNumber does not have any constraint parameters, so you cannot do much in this case. You could add a second constraint to it:

class User {
    @Pattern(regexp = "[\\d\\s-]+") // accepting numbers, white spaces and dashes
    @CreditCardNumber
    public String cardNumber;

I think we will add this type of additional pattern constraints to CreditCardNumber for the next Validator release.