Could you please enlighten me to what am I doing wrong?

When you interpolate the string $number_string into the regex qr/.*$card,$sim.*$number_string.*/ the backslash you originally had on the '+' sign is effectively 'used up'. So by the time the regex comes to be used, that '+' will be treated as a regex meta character, specifically a quantifier modifier, for the preceding space.

Often when interpolating a string into a regex, the way to ensure any meta-like characters within as treated as literals is to bracket the interpolated variable in \Q and \E.

eg. qr/.*$card,$sim.*\Q$number_string\E.*/.

But as the string actually contains meta-characters that you want recognised as such, the other option is to double the backslashes on the '+' so that one remains by the time the regex is used. Ie.

my $number_string = 'Your number is \\+([0-9]+)';

$exp->expect($timeout,
        [ qr/.*$card,$sim.*$number_string.*/,
        ...
[download]

Which should resolve this particular problem.