As explained by OP, what they are doing is using your website name / business name / trademark name as their campaign's keywords and that part is very much allowed as per Google Ads. I am myself running Google Ads campaigns (selling Youtube views) and I have "youtube" in my campaign's keywords, as it is allowed to do so (and I do not even need to cloak the campaign : it is pure whitehat).
However, usage of trademarks, etc in the ad headlines, ad descriptions is not allowed as per Google Ads (keeping blackhat strategies apart).
Next : From their advertised website, they are scamming people (which is bad, something illegal and not allowed). But, they are able to do that using cloaking (safe page, money page).
To be honest, nothing can be done about it, apart from what OP mentioned : out-bidding them. Even if one complains to Google Ads about it, the perpetrators of the same are always having a farm of accounts on an ongoing basis and Google Ads themselves have been unable to stop it from happening so far. Google has realized even by totally disallowing a niche or disallowing some keywords to be advertised in Google Ads, still perpetrators are able to run their ads in Google Ads, through alternative allowed keywords along with cloaking.