Can a phone clone a tag on its own?
A phone with an ordinary application reads what is written on a tag and writes it to a blank one, which is what most people mean by cloning. It cannot set an identifier, cannot reproduce chip configuration, and cannot reach anything that requires low level control of the exchange.
What a phone can do
Read the content of a tag and write that content to another tag. No specialist equipment, no cable, no expertise beyond installing an application.
That covers the great majority of what people have in mind when they worry about cloning, because the great majority of tags hold nothing but content.
Take NFC Tools. On iOS it requires an iPhone 7 or later running iOS 15.6 or later, and the app must be launched manually. Background reading is available from the iPhone XS and XR onwards.
What it cannot
Set the identifier of the destination tag. On ordinary tags the identifier is fixed at manufacture and no application can change it.
Carry across chip configuration: a password, the lock state, mirroring settings. These live outside the content and are not part of what is read.
Reach protocols that need control below the level a phone exposes to applications. Both platforms present a tag through their own interface, and an application only sees what that interface offers.
Reproduce anything that was never transmitted, which is the case for any credential that proves itself rather than announcing itself.
Why the limits exist
Two separate causes, and it is worth keeping them apart.
Some limits are physical and permanent. A secret that never leaves a chip cannot be captured by a better application, on any platform, ever.
Others are platform decisions. What an application is allowed to do with the radio is chosen by the operating system, and iOS and Android choose differently.
Confusing the two leads to a permanent search for the application that will do the impossible thing, which is a search with no end.
What that means for you
Assume anybody with a phone can duplicate the content of your tag. That is a low bar and it is met everywhere.
Do not assume the same about identity. A system relying on the identifier is not defeated by a phone, though it may be defeated by other hardware, which is a separate and real concern.
And when a supplier says their tag cannot be cloned, ask what they mean by cloned. The content always can be, and a great deal of marketing rests on the ambiguity.
Frequently asked questions
Can an application change a tag's identifier?
Not on an ordinary tag, where it is fixed at manufacture. No application on either platform can alter it.
Does the copy carry the password?
No. Chip configuration lives outside the content and is not part of what an application reads.
Is it a platform limitation or a physical one?
Both, depending on the case. A secret that never leaves the chip is physical. What an application may do with the radio is a platform decision.
So a tag cannot be cloned by a phone?
Its content can, easily. Its identity cannot. Which of the two matters is decided by whatever is on the other side.