What can actually be cloned from an NFC tag?
Everything written on it, in seconds, by anybody who can hold a phone near it. What does not copy is the identifier, which is fixed at the factory on an ordinary tag. Whether the copy is dangerous therefore depends on which of the two the system on the other side relies on.
The content copies completely
Whatever is written on a tag can be read by anybody with a phone and written to a blank one. There is no permission step, no trace, and no way for the original owner to know it happened.
That includes an address, a contact record, a network credential, plain text, and anything else stored as content. All of it, exactly.
Treat everything written on a tag as public. Not because copying is easy, though it is, but because reading is the tag's entire function and you cannot have one without the other.
The identity does not
Every tag carries an identifier assigned at manufacture, and on an ordinary tag it cannot be changed. A copy is therefore a different tag holding the same words.
Neither does the configuration around the content: a password set on the chip, the lock state, and settings that live outside the content area all stay with the original.
The mechanics of that, and why a copy sometimes misbehaves as a result, belong to the writing side of the subject and are set out in the guide to copying a tag.
When the difference matters
It matters exactly when something on the other side is relying on the identifier rather than on the content.
A door that compares an identifier against a list is defeated by anything presenting that identifier, and defeated not at all by a copy that presents a different one.
A page that opens from an address does not care which tag sent the reader there, so a copy works perfectly and gains nothing that a single tap would not have given anyway.
Between those two poles sits everything else, and the position of your own case is decided by the system, never by the tag.
The question to ask instead
Not can this be copied, because it can. What would somebody hold if they copied it.
If the answer is a public address, the copy is worthless and no protection is warranted.
If the answer is entry, payment or identity, then the tag was never the right place for that trust, and the fix is on the system side rather than on the tag.
Take NFC Tools. On iOS it requires an iPhone 7 or later running iOS 15.6 or later, and the app must be launched manually. Background reading is available from the iPhone XS and XR onwards.
Frequently asked questions
Can the identifier be copied?
Not onto an ordinary tag. It is assigned at manufacture and read only, so a copy is a different tag holding the same content.
Does a copy carry the password across?
No. A password lives in chip configuration rather than in the content, and it stays with the original.
Is copying detectable?
Not by the tag. Nothing is written and nothing is recorded, so the owner has no way of knowing it happened.
What should I do about it?
Decide what a copy would be worth. If the answer is a public page, nothing. If the answer is a door, move the trust off the tag.