Can an NFC tag carry a virus?
No, in the sense that a tag cannot hold or execute a program. It is a small amount of passive memory with no processor of its own to run anything. What it can hold is an address, and an address leading somewhere harmful is the realistic version of this worry.
Why it cannot
A tag is memory with an interface. It has no processor that executes anything, so there is nothing on a tag that runs.
Whatever is written is data, returned when asked for. What happens next is decided entirely by the phone and by the application that receives it.
A virus in the ordinary sense needs somewhere to execute and something to spread through. A tag offers neither, and cannot be modified to offer them.
The size argument as well
Ordinary tags hold a few hundred bytes to a few kilobytes. That is enough for an address, a contact record or a short piece of text.
It is not enough for a program of any kind, even setting aside the fact that nothing would run it.
So the answer holds twice over, which is worth stating because people expect a qualification and there is not one at this level.
What a tag can actually do
Hold an address that leads to a page designed to deceive you, exactly as a printed link can. This is the realistic version and it is a social attack rather than a technical one.
Hold content shaped to provoke a fault in whatever parses it, which is a question about the reading software rather than about NFC, and is covered separately.
Trigger a routine on your own phone that you configured, which is not an attack unless somebody else configured it.
None of these is a virus, and calling them one obscures what to actually do about them.
The habit that covers it
Read unfamiliar tags rather than acting on them, using an application that shows the content and stops there.
Look at the address before following it, applying the same judgement you would to a link in a message from a stranger.
And treat anything asking you to install something, sign in, or enter details as the point where the actual risk begins, because it is.
Take NFC Tools. On iOS it requires an iPhone 7 or later running iOS 15.6 or later, and the app must be launched manually. Background reading is available from the iPhone XS and XR onwards.
Frequently asked questions
Can a tag infect my phone?
No. A tag has no processor and holds a few hundred bytes. There is nothing on it that runs.
What about a very large tag?
Size is the secondary argument. Even a large tag has nothing that executes, so the answer does not change.
So what is the real risk?
An address leading somewhere designed to deceive you. That is a social attack, handled by looking before following.
Should I scan tags with an antivirus?
There is nothing to scan. Reading the content and judging the address is the equivalent action.