Can someone copy your NFC business card?
Yes, in a few seconds, and the answer that matters is what a copy gives them: the address you hand to strangers on purpose. Anyone can already visit that address by tapping your card once. A copy lets someone hand out your details, which is a nuisance rather than a breach.
What a copy actually contains
An address, in nearly every case, pointing at a page you publish. That is the whole content of most cards sold for this purpose.
Some cards hold a contact record directly instead, which copies just as completely and contains only what you chose to put in it.
Neither contains anything that gives access to an account, since a card has no way of holding a credential that would.
What harm it could do
Somebody could hand out a card that leads to your page. They could already do that by handing out your actual card, or by writing your address on a piece of paper.
They could put your address on an object of their own, which is the only version with any teeth: your details appearing somewhere you did not choose.
What they cannot do is change what your page says, because the page is yours, and a copy of the card confers no control over it.
That last point is the reassuring one and it is why a card pointing at a page you control is safer than a card carrying the details directly.
The risk that is real
Not copying. Rewriting.
An unlocked card left on a desk or handed round a table can be overwritten by anybody with a phone, and it will then point wherever they chose. You would not notice until somebody told you.
This is why locking a card matters, and locking guards against exactly this and nothing else. It does not prevent copying, and no card sold anywhere does.
Take NFC Tools. On iOS it requires an iPhone 7 or later running iOS 15.6 or later, and the app must be launched manually. Background reading is available from the iPhone XS and XR onwards.
What to do about it
Point the card at an address on a domain you control, so you can change where it leads without touching the card.
Lock it once you are satisfied with what is written, which protects the one thing that can actually be taken from you.
Keep off the card anything you would not put on a printed one. A card is read by anybody who handles it, and there is no way to make part of it private.
And accept the rest. A business card is an object whose purpose is to be given away, and worrying about it being copied is worrying about it working.
Frequently asked questions
Can somebody get into my accounts with a copy?
No. A card holds an address or a contact record, not a credential. There is nothing on it that authorises anything.
Can they change what my card points to?
Only by rewriting your actual card, which is why locking it matters. A copy gives them no control over your page.
Should I lock my card?
Yes, once the content is settled. Locking prevents somebody overwriting it, which is the realistic risk.
Does locking stop it being copied?
No, and nothing does. Reading is what a card is for, and copying is reading followed by writing.