Is your tag worth cloning to anyone?
Usually not, and asking costs nothing. Copying requires physical proximity for the duration of a read, a blank tag, and a reason. Against a tag that opens a public page, the attacker gains a page anybody can already open, which is why most home and marketing tags are never touched.
What a copy costs to make
Physical proximity, sustained. A blank tag. An application. And the willingness to be standing next to something that belongs to somebody else.
None of that is expensive, which is why the answer to can it be copied is always yes. The cost is not the obstacle.
The obstacle is the last item, and it is a social cost rather than a technical one: somebody has to be there, doing it, where they can be seen.
What it gains
Whatever the tag holds, which for the overwhelming majority of tags is an address that the owner is actively trying to get people to visit.
A marketing tag on a poster gains a copy of a poster. A tag on a business card gains contact details that were being handed out. A tag by the front door that turns on the lights gains nothing at all, because the automation lives on the owner's phone.
Set against that, the effort of copying is not worth anybody's afternoon, and the empirical evidence agrees: tags in public places are far more often overwritten as vandalism than copied for gain.
The cases that do warrant protection
Where the tag is the credential. Entry, membership, a ticket, anything that grants rather than informs.
Where the tag asserts authenticity. A tag proving an item is genuine is worth copying precisely because the copy would then prove a counterfeit is genuine.
Where the identifier is the product. Systems that bill, count or track per item are defeated by anything presenting a known identifier.
Three cases, and if yours is not one of them, protection against copying is money spent on a threat you do not have.
Spending in proportion
Work out what somebody would hold after copying. Write it down in one sentence. If that sentence describes something harmless, stop there.
Spend instead on the failure that is actually common: a tag being overwritten, a tag failing after installation, or a destination that stops existing.
Those three account for nearly all real losses in tag deployments, and none of them is addressed by anti copying measures.
Protection that is proportionate gets maintained. Protection bought out of anxiety gets abandoned at the first inconvenience.
Frequently asked questions
Is it worth protecting a marketing tag against copying?
Rarely. A copy gains somebody an address you are actively trying to publicise.
Which tags genuinely need it?
Ones that grant something, ones that assert authenticity, and ones whose identifier is billed or counted.
What is the more common failure?
Being overwritten, failing after installation, or pointing at a destination that no longer exists.
How do I decide?
Write in one sentence what somebody would hold after copying. If it is harmless, spend the money elsewhere.