It probably makes more sense to test for digits and whitespace, and then ensure that the whitespace-stripped version is valid (to account for spaces in the number trailing newlines, etc). Also, it shouldn't use a hard-coded 16 (AmEx etc.); it should probably test with `validateCardNumber`.