Hello,
The problem you might run into is that credit card numbers are a little more complicated than that. I don't believe you will be able to use a simple regex or wildcard rule to accurately block them.
I know that the Symantec Brightmail Gateway has the ability to block credit card numbers per a pre-populated rule, so there is no extra configuration needed. The issue there is that how they are blocked is proprietary.
Sorry, I know that is a little less than helpful but if you are able to look at the SBG appliance it would be a good option.
Thanks!
Tom