There are several options for users to receive an SMS or Voice call rather than a PUSH.
If PUSH is enabled in the Validation Server settings, VIP will use that method if the user has a PUSH-enabled credential.
If PUSH is not enabled but Access-Challenge is, and the user has an SMS or Voice credential assigned, the code will be sent to the credential during the 'challenge' cycle.
If using the VIP Javascript integration with the out-of-band option enabled, the user can select to receive an 'out of band' security code via SMS, Voice, or Email.