It is possible to enroll hardware tokens, but I believe SMS is a prerequisite.

It's also allegedly possible to deactivate in a bunch of other ways, e.g. by adding a new credit card.

https://github.com/dlenski/python-vipaccess