How do you protect a deployment against copying?

What does not work

Locking. It prevents the tag being rewritten and has no bearing on it being read, and copying is reading followed by writing to a different tag.

A password on the write operation, for the same reason.

Obscurity in the content. Encoding the payload so it looks unintelligible copies just as perfectly, since the copy does not need to understand it.

A serial number written into the content. Anybody who can read it can write it, and a copy carries it across faithfully.

Each of these is sold, in places, as protection against copying. None of them is, and a deployment built on one of them will be discovered late.

Protection at the chip

The category that works is a chip that proves something rather than stating it: it holds a key, the key never leaves, and it answers a challenge in a way that cannot be replayed.

A related and cheaper family produces a value that changes on every read, so that a captured response is stale by the time it could be used.

The families available, their names, and what each costs per unit belong to the chip datasheets, which are maintained by the manufacturers rather than duplicated here.

The cost is not only the chip. Verifying what the chip produces requires something on your side that holds the corresponding secret, and that infrastructure is the part that surprises people.

Protection at the system

Often better value, and always worth considering first: arrange matters so that a copy gains nothing even if it is made.

Bind the tag to something else. A tag that is meaningful only alongside a login, a location, a time window or a physical seal is a tag whose copy is inert.

Use the tag as one signal rather than as the decision. A system that notices the same identifier appearing in two places within a minute has caught something no chip feature would have prevented.

And reduce what the tag is trusted with, which is free.

Choosing between them

Start from what a copy would gain, because that determines the budget. A copy that gains a public page justifies nothing.

Where protection is warranted, price the whole arrangement rather than the chip: the chips, the verification infrastructure, and the operational work of managing keys over the life of the deployment.

Compare that against a system side measure that may achieve the same outcome with tags you can buy anywhere.

And be sceptical of a supplier who answers cannot be cloned without saying which part cannot. The content always can be.