A CA is supposed to make sure that the certificates it issues contain only truthful information. How they do that is their business; serious CA are supposed to publish detailed "Certification Practice Statements" that document their procedures.
In practice, when you want to buy a certificate for a
www.myshop.com domain, the CA "challenges" you, so that you demonstrate that you indeed have control of that domain. Some classic methods include:
The CA sends you a piece of random data, to include as a host name in the domain. You thus demonstrate your control of the DNS related to the domain.
The CA sends you a piece of random data that you must put for download (over plain HTTP) from the
www.myshop.com site. You thus show that you control the main server that corresponds to the domain.
The CA sends that piece of random data over an email sent to
email@example.com. You return back that data to them, thereby demonstrating that you can read the emails sent to the administrator of the domain.
None of these mechanisms is really strong; and, moreover, it suffices for an attacker to succeed in fooling one CA among the hundred or so that are trusted by default by usual Web browsers. Nevertheless, fraudulent certificates appear to be a rarity (say, once or twice per year, worldwide), so one has to admit that these authentication mechanisms, however flimsy they look, must be good enough for the job.
As for mistyped domain, it is a very classic method which is commonly handled by either buying those mistyped domains, or unleashing your lawyers on whoever tries to buy a domain that seems to be "too close" to your own domain.