If it is a basic data providing tag, then it can be cloned. If it is a secure tag, it is far more difficult.
For secure cards used for payments and authentication, a private key is loaded on to the card and the card never discloses it. The public key is kept by the bank or whoever needs to be able to verify that the card was used. If, for example, the card is used for a payment, the vendor's terminal feeds information about the transaction to the card and asks the card to sign the transaction. The card signs the transaction and returns the signature to the reader. This signature allows the vendor to prove to the credit card company that the card was used for that transaction, but it doesn't give the vendor the information needed to clone the card.
There are potentially ways to etch off layers of the card and directly access the circuitry that holds the keys, but such methods are unreliable and difficult to execute, particularly since a good secure tag should be designed to be tamper resistant.
There are some attacks against older protocols that should be going out of use now, but generally speaking, a good, modern, secure tag should not be cloneable. That is the entire point of using this kind of technology rather than a magnetic strip (which is easily cloneable.)