Usually you do a lot more than just counting digits. Credit card numbers have various mathematical properties that can be used to detect 'tpyos.'
I usually program all such record-validation tests in a method that will fire just before the record posts. I usually do not trigger them on-exit from the field. It is nice when the routine checks all of the fields at once for errors, and lists all of the error-messages found.
Virtually any book covers record validation as one of its main topics.