My point being that asserts direct most programmers to copy and paste the same code that you should have used earlier on in your app to check if the card number was valid -- a regex or a sub -- whatever. This not only is redundant it also give the developer a false sense of a safety net (if his code did not verify the card correctly before it will/may not now). I think it is better to use a well established test harness to actually test a bad card number insert in multiple ways and verify the expected behavior happens.
In my mind asserts are just as bad as mixing the display logic of web apps with the program logic -- in small apps just use print statements to debug or whatever you are comfortable with. In large complex apps do debugging and testing in specialized areas -- there is a reason it is called the debugger you know.