Credit card validation is one of those things where regex does not quite cut it. joi.string().creditcard() perhaps?

References:

http://en.wikipedia.org/wiki/Luhn_algorithm
http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=39698