How do you tell if a tag is a clone?
By comparing what a copy cannot bring with it against a record of what you deployed. The identifier differs, the chip may differ, the lock state did not follow, and any password you set was not carried over. Without that record beforehand, none of these checks tell you anything.
It starts before deployment
Every check for a copy is a comparison, and a comparison needs something to compare against. That something has to be recorded when the tags are written, not afterwards.
The identifier of each tag, where it went, what was written on it, and whether it was locked. Four columns, captured during a run that was happening anyway.
Skip that and there is no test available later. A tag in your hand looks exactly like a tag somebody else wrote, because it is the same object.
The checks that work
The identifier, first and most useful. A copy is a different tag and returns a different identifier, so an identifier absent from your register did not come from you.
The lock state. A copy of a locked tag is unlocked, because locking is an action rather than content, so an unlocked tag where you deployed locked ones is suspect.
The password. If your tags carry one and this one does not, it was not written by you.
The chip itself. A copy onto a different product changes the memory size and the type, which is visible in what a reader reports.
Checking in the field
Any application that shows a tag's identifier and technical details is enough for this, and no specialist equipment is needed.
Take NFC Tools. On iOS it requires an iPhone 7 or later running iOS 15.6 or later, and the app must be launched manually. Background reading is available from the iPhone XS and XR onwards.
For a deployment of any size, make the check part of a routine inspection rather than something done after a suspicion. A check performed only when somebody is worried is a check that catches nothing.
And record the result, including the ones that passed, because the value of a register is in its completeness.
What detection cannot give you
It cannot tell you that a copy exists somewhere else. Copying leaves the original untouched and unmarked, so the original tells you nothing.
It cannot tell you when a substitution happened, only that the tag in front of you is not the one you installed.
And on a system that authorises on the identifier, a determined adversary presenting a known identifier is not distinguishable by these checks at all, which is the argument for not authorising on an identifier in the first place.
Detection is therefore a control for substitution rather than a defence against duplication, and it is worth having on exactly that understanding.
Frequently asked questions
Can I tell if my tag has been copied?
No. Copying leaves the original unchanged, so the original carries no evidence. You can only detect a substitution.
What is the single most useful check?
The identifier, compared against a register made when the tags were written. Everything else is secondary.
Do I need special equipment?
No. Any application that reports a tag's identifier and technical details is sufficient.
What if I never recorded anything?
Then there is no check available. A tag in your hand is indistinguishable from one somebody else wrote.