String source = " <card>1234567890123456</card> t <card>1234 5678 9012 3456</card>";
    String result1, result2;

    // Variant 1
    Pattern p1 = Pattern.compile("(<card>[\\d\\s]{4,})([\\s]{0,})([\\d]{2})(?:[\\d]{2})([\\s]{0,})(?:[\\d]{4})([\\s]{0,})([\\d\\s]{4}</card>)");
    result1 = p1.matcher(source).replaceAll("$1$2$3**$4****$5$6");

    // Variant 2
    Pattern p2 = Pattern.compile("<card>[\\d\\s]{12,20}</card>");
    Matcher m = p2.matcher(source);
    result2 = source;
    while (m.find())
      result2 = result2.substring(0, m.start() + 12)
              + result2.substring(m.start() + 12, m.end() - 11).replaceAll("\\d", "*")
              + result2.substring(m.end() - 11, result2.length());

    System.out.println(source);  // <card>1234567890123456</card> t <card>1234 5678 9012 3456</card>
    System.out.println(result1); // <card>123456******3456</card> t <card>1234 56** **** 3456</card>
    System.out.println(result2); // <card>123456******3456</card> t <card>1234 5*** **** 3456</card>